package secrets and machined too

All four repo binaries were hand-copied to the phone and owned by no
package. secrets/machined ship on both arches; sessiond stays aarch64.
secrets unit repointed /usr/local/bin -> /usr/bin.

.gitea/workflows/ci.yml

@@ -119,18 +119,38 @@ jobs:
           file "$SBIN" | grep -q aarch64 || { echo "sessiond is not aarch64" >&2; exit 1; }
           cp "$SBIN" souveraine-sessiond-aarch64
 
+          # secrets rail + machined: also hand-copied on the phone until now.
+          ./scripts/build-cross.sh --features secrets --bin souveraine-secrets
+          ./scripts/build-cross.sh --bin souveraine-machined
+          for b in souveraine-secrets souveraine-machined; do
+            B="$CARGO_TARGET_DIR/aarch64-unknown-linux-gnu/release/$b"
+            file "$B" | grep -q aarch64 || { echo "$b is not aarch64" >&2; exit 1; }
+            cp "$B" "$b-aarch64"
+          done
+
           export CARGO_TARGET_DIR="$HOME/.cache/souveraine-ci-target-x86_64"
           cargo build --release
           BIN="$CARGO_TARGET_DIR/release/souveraine"
           file "$BIN" | grep -q 'x86-64' || { echo "built binary is not x86_64" >&2; exit 1; }
           cp "$BIN" souveraine-x86_64
 
+          cargo build --release --features secrets --bin souveraine-secrets
+          cargo build --release --bin souveraine-machined
+          for b in souveraine-secrets souveraine-machined; do
+            B="$CARGO_TARGET_DIR/release/$b"
+            file "$B" | grep -q 'x86-64' || { echo "$b is not x86_64" >&2; exit 1; }
+            cp "$B" "$b-x86_64"
+          done
+
           # sessiond is deliberately NOT built for x86_64: the laptop hit
           # lock-screen errors with it, and it is the phone's session authority.
           # Ship it on aarch64 only until the laptop side is sorted.
 
           sha256sum souveraine-aarch64 souveraine-x86_64 \
-            souveraine-sessiond-aarch64 > souveraine-binaries.sha256
+            souveraine-sessiond-aarch64 \
+            souveraine-secrets-aarch64 souveraine-secrets-x86_64 \
+            souveraine-machined-aarch64 souveraine-machined-x86_64 \
+            > souveraine-binaries.sha256
 
       - name: Build UPower fork (per-arch install trees)
         run: |
@@ -237,7 +257,11 @@ jobs:
             ARCH_REPO="$REPO/$ARCH"
             mkdir -p "$PKG_WORK" "$ARCH_REPO"
             cp "souveraine-$ARCH" "$PKG_WORK/souveraine-binary"
-            cp packaging/souveraine.service LICENSE "$PKG_WORK/"
+            cp "souveraine-secrets-$ARCH" "$PKG_WORK/souveraine-secrets-binary"
+            cp "souveraine-machined-$ARCH" "$PKG_WORK/souveraine-machined-binary"
+            cp packaging/souveraine.service packaging/souveraine-secrets.service \
+               packaging/org.freedesktop.secrets.service \
+               packaging/souveraine-machined.service LICENSE "$PKG_WORK/"
             # aarch64 only — see the sessiond note in the build step.
             if [ "$ARCH" = aarch64 ]; then
               cp "souveraine-sessiond-$ARCH" "$PKG_WORK/souveraine-sessiond-binary"

packaging/arch/PKGBUILD.prebuilt

@@ -12,8 +12,12 @@ url="https://gitea.wiuf.net/Fimeg/souveraine"
 license=('MIT')
 depends=('gcc-libs' 'alsa-lib')
 options=('!strip')
-source=('souveraine-binary' 'souveraine.service' 'LICENSE')
+source=('souveraine-binary' 'souveraine.service'
-sha256sums=('SKIP' 'SKIP' 'SKIP')
+        'souveraine-secrets-binary' 'souveraine-secrets.service'
+        'org.freedesktop.secrets.service'
+        'souveraine-machined-binary' 'souveraine-machined.service'
+        'LICENSE')
+sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
 # sessiond ships on aarch64 only (the phone is its target; the laptop hit
 # lock-screen errors with it). CI drops the two files into the build dir for
 # that arch and omits them otherwise, so package() picks them up conditionally
@@ -37,5 +41,18 @@ package() {
         install -Dm644 "$srcdir/souveraine-sessiond.service" \
             "$pkgdir/usr/lib/systemd/user/souveraine-sessiond.service"
     fi
+    # Secrets rail (user service, owns org.freedesktop.secrets) and machined
+    # (system service, machine identity). Both were hand-copied to the phone
+    # and owned by no package — same gap as sessiond.
+    install -Dm755 "$srcdir/souveraine-secrets-binary" "$pkgdir/usr/bin/souveraine-secrets"
+    install -Dm644 "$srcdir/souveraine-secrets.service" \
+        "$pkgdir/usr/lib/systemd/user/souveraine-secrets.service"
+    install -Dm644 "$srcdir/org.freedesktop.secrets.service" \
+        "$pkgdir/usr/share/dbus-1/services/org.freedesktop.secrets.service"
+
+    install -Dm755 "$srcdir/souveraine-machined-binary" "$pkgdir/usr/bin/souveraine-machined"
+    install -Dm644 "$srcdir/souveraine-machined.service" \
+        "$pkgdir/usr/lib/systemd/system/souveraine-machined.service"
+
     install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
 }

packaging/souveraine-secrets.service

@@ -13,7 +13,7 @@ Requires=dbus.socket
 [Service]
 Type=dbus
 BusName=org.freedesktop.secrets
-ExecStart=/usr/local/bin/souveraine-secrets
+ExecStart=/usr/bin/souveraine-secrets
 Restart=on-failure
 RestartSec=5
 Environment=RUST_LOG=info