[kwsantiago]

Builds the sargo image on every push and pull request to main, then runs verify.sh and the negative test on it, on a native ubuntu-24.04-arm runner.

Change

• .github/workflows/image.yml: unit tests (style check, test-android-image.py, test-backends.sh), then the in-repo packages, the image, verify and the negative test. The image and build log are uploaded for 7 days. contents: read only, no secrets, every action pinned by SHA, and checkout does not persist credentials. The image carries no SSH key or Wi-Fi credentials. Only the kernel is cached, keyed on its own directory; every other in-repo package is rebuilt each run.
• PKGBUILD_ONLY in docker/build-packages.sh (passed through by provision.sh) builds only the named in-repo recipes and skips the manifest components and AUR rebuilds. Unset, the build is unchanged. It also serves single-package iteration: PKGBUILD_ONLY=moarchy.
• docker/Dockerfile.builder installs megapixels' build dependencies, which a full build only had because a manifest component's makepkg -s pulled them in; its PKGBUILD now declares gperf and libpulse (pkgrel 2).
• scripts/fetch-published.sh <dir> fills in everything else from the signed [moarchy] repo the manifest names. It verifies the database and every package against pkgbuilds/moarchy-keyring (the primary key fingerprint from VALIDSIG), records each hash in .build-manifest so pkgset_vouched accepts them, and removes anything the manifest does not vouch for. The published repo can trail the manifest pins, so a CI image tests this tree, not a release.
• image/verify.sh: three stale checks fixed. The device tile is org.moarchy.Device.plugin.desktop. The shell must have no Quickshell.I3 imports and at least one Quickshell.Hyprland import, matching omarchy-config's inverted A2.

Not covered

• A PR that moves a manifest component or AUR pin goes green without building it, since those come from the published repo.
• The fetch script's refusal paths are tested by hand (below), not in CI.

Testing

Locally, fetch-published.sh against the real repo, with a manifest vouching for all but three packages: it fetched and vouched the three, removed an unvouched file, and refused a package whose signature had been swapped. It also refused a tree package missing from the manifest and a validly signed package served under another package's filename.

CI on this branch: verify reports all checks passed (including the online resize2fs growth), and the negative test catches all 11 planted defects. About 11 minutes with the kernel cached.