mirror souveraine + upower-souveraine into the Gitea Arch registry

Best-effort mirror step after the edge publish: PUT each built pkg to
/api/packages/Fimeg/arch/edge so the Packages page stays current. Never
fails the publish; 409 = bump to republish. Runs only on public (same
gate as the publish job).

.gitea/workflows/ci.yml

@@ -406,6 +406,31 @@ jobs:
             souveraine-aarch64 souveraine-x86_64 souveraine-binaries.sha256 \
             "$GITHUB_WORKSPACE/pacman-repo/souveraine-archive-key.asc"
 
+      - name: Mirror into the Gitea Arch registry (alongside edge)
+        # Best-effort, never fails the publish: the registry sits alongside
+        # release-assets until proven as the phone's source. A 409 means
+        # (name, version) is already present immutably -- bump to republish.
+        # Device-side auth is handled by souveraine-pacman-fetch; this only
+        # uploads. Covers souveraine + upower-souveraine (both arches).
+        env:
+          EDGE_TOKEN: ${{ secrets.LOCAL_GITEA_TOKEN }}
+        run: |
+          set +e
+          REG="$GITHUB_SERVER_URL/api/packages/${GITHUB_REPOSITORY%/*}/arch/edge"
+          ok=0; skip=0; bad=0
+          shopt -s nullglob
+          for pkg in "$GITHUB_WORKSPACE"/pacman-repo/*/*.pkg.tar.zst; do
+            code=$(curl -s -o /dev/null -w "%{http_code}" -X PUT \
+              -H "Authorization: token $EDGE_TOKEN" --upload-file "$pkg" "$REG")
+            case "$code" in
+              200|201) echo "registry: published $(basename "$pkg")"; ok=$((ok+1));;
+              409)     echo "registry: present $(basename "$pkg") (bump to republish)"; skip=$((skip+1));;
+              *)       echo "::warning::registry $(basename "$pkg") -> HTTP $code"; bad=$((bad+1));;
+            esac
+          done
+          echo "registry mirror: $ok new, $skip present, $bad failed"
+          exit 0
+
   # Mirror the published branch only. primary (dev) never reaches Codeberg.
   sync-codeberg:
     runs-on: ubuntu-latest