packaging: adopt the phone deploy script and Arch PKGBUILD

Both were stranded untracked in the Pixel3Arch tree; they source from
this repo, so they live here. deploy-phone.sh ships the cross-built
binary + user unit (seed-id excluded, machine binding stays doctrine);
PKGBUILD builds from a synced local checkout, no network fetch.

packaging/arch/PKGBUILD

@@ -0,0 +1,38 @@
+# Maintainer: Fimeg <casey.tunturi@gmail.com>
+# Souveraine — sovereign agent substrate. Part of the SouveraineOS layer;
+# the phone runs the same server + agents as the desktop.
+pkgname=souveraine
+pkgver=0.1.0
+pkgrel=1
+pkgdesc="Sovereign agent substrate — server, TUI, surfaces"
+arch=('aarch64' 'x86_64')
+url="https://github.com/Fimeg/souveraine"
+license=('MIT')
+depends=('gcc-libs')
+makedepends=('cargo' 'git')
+options=('!lto')
+
+# Build from the local checkout synced by deploy-souveraine.sh (or a git
+# clone at /home/casey/souveraine-src on device). No network fetch — the
+# phone builds what the laptop ships.
+_srcdir="/home/casey/souveraine-src"
+
+pkgver() {
+    cd "$_srcdir"
+    git describe --tags --always 2>/dev/null | sed 's/^v//;s/-/./g' || echo "$pkgver"
+}
+
+build() {
+    cd "$_srcdir"
+    cargo build --release --locked
+}
+
+package() {
+    cd "$_srcdir"
+    install -Dm755 target/release/souveraine "$pkgdir/usr/bin/souveraine"
+    # repo unit points at ~/.local/bin (desktop dev install); packaged unit
+    # runs the pacman-owned binary
+    sed 's|%h/.local/bin/souveraine|/usr/bin/souveraine|' packaging/souveraine.service \
+        | install -Dm644 /dev/stdin "$pkgdir/usr/lib/systemd/user/souveraine.service"
+    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+}

packaging/deploy-phone.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+# deploy-souveraine.sh — ship a cross-built Souveraine to the Pixel 3.
+#
+# The binary is cross-compiled on this box by the souveraine repo's
+# scripts/build-cross.sh (target/aarch64-unknown-linux-gnu/release/souveraine,
+# linked against the /usr/aarch64-linux-gnu sysroot). This script ships that
+# binary + the systemd user unit — no on-device build, no makepkg, no phone
+# RAM pressure. Binary lands in /usr/local/bin (pacman's /usr/bin is reserved
+# for packaged software; this isn't a pacman package). Redeploy = rerun.
+#
+# Data: mirrors ~/.souveraine (agents, memfs, tokens, db).
+# Identity: ~/.souveraine/seed-id is EXCLUDED by default. Machine binding
+# is doctrine — the phone is its own federated instance and generates its
+# own seed on first start. --clone-identity overrides for a deliberate
+# same-instance migration.
+set -euo pipefail
+
+SSH=(ssh -F /dev/null -i "$HOME/.ssh/ani" -o BatchMode=yes -o ConnectTimeout=5)
+SCP=(scp -F /dev/null -i "$HOME/.ssh/ani" -o BatchMode=yes)
+USB_IP=172.16.42.1
+WIFI_IP=10.10.20.154
+SRC="$HOME/Projects/souveraine"
+UNIT="$SRC/packaging/souveraine.service"
+BIN="$SRC/target/aarch64-unknown-linux-gnu/release/souveraine"
+
+clone_identity=0
+[[ "${1:-}" == "--clone-identity" ]] && clone_identity=1
+
+# Build locally if the binary is missing or older than the source.
+# ponytail: find -newer reruns the cross build only when something changed
+if [[ ! -f "$BIN" ]] || \
+   [[ -n "$(find "$SRC/src" "$SRC/Cargo.toml" -newer "$BIN" 2>/dev/null)" ]]; then
+    echo "== cross-build (source newer than binary) =="
+    "$SRC/scripts/build-cross.sh" >/dev/null
+fi
+
+ip=""
+for cand in "$USB_IP" "$WIFI_IP"; do
+    if ping -c1 -W1 "$cand" >/dev/null 2>&1; then ip="$cand"; break; fi
+done
+[[ -n "$ip" ]] || { echo "phone unreachable (tried $USB_IP, $WIFI_IP)" >&2; exit 1; }
+PHONE="casey@$ip"
+echo "== phone: $ip =="
+
+echo "== binary =="
+"${SCP[@]}" "$BIN" "$PHONE:/tmp/souveraine-xdev"
+"${SSH[@]}" "$PHONE" 'sudo install -Dm755 /tmp/souveraine-xdev /usr/local/bin/souveraine && rm /tmp/souveraine-xdev'
+
+echo "== systemd unit =="
+# Repo unit runs %h/.local/bin (desktop dev install); point it at the shared binary.
+sed 's|%h/.local/bin/souveraine|/usr/local/bin/souveraine|' "$UNIT" \
+    | "${SSH[@]}" "$PHONE" 'install -Dm644 /dev/stdin ~/.config/systemd/user/souveraine.service'
+
+echo "== ~/.souveraine data =="
+excludes=(--exclude 'seed-id')
+[[ $clone_identity -eq 1 ]] && excludes=()
+rsync -az -e "ssh -F /dev/null -i $HOME/.ssh/ani -o BatchMode=yes" "${excludes[@]}" \
+    "$HOME/.souveraine/" "$PHONE:.souveraine/"
+
+echo "== enable + start =="
+"${SSH[@]}" "$PHONE" '
+    systemctl --user daemon-reload
+    systemctl --user enable souveraine.service 2>/dev/null || true
+    systemctl --user restart souveraine.service
+    sleep 2
+    systemctl --user is-active souveraine.service
+    curl -sf --max-time 3 http://127.0.0.1:8484/health && echo " health: ok"
+'
+
+echo "== done =="
+[[ $clone_identity -eq 0 ]] && echo "note: seed-id excluded — phone keeps/generates its own federated identity"