ci: pin tuie to fork sha + aarch64 artifact job

tuie now cloned from Fimeg/tuie (rgb patch committed) at a pinned SHA
instead of upstream HEAD — no floating ref decides if we build.

aarch64-artifact job runs on the new archdev host-mode runner, cross-
builds against ~/aarch64-sysroot (linker --sysroot flag proven to find
aarch64 libmvec), publishes the binary to a rolling edge prerelease
when CI is green. Phone updates itself from there.

.gitea/workflows/ci.yml

@@ -18,10 +18,12 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Install system deps
         run: sudo apt-get update -qq && sudo apt-get install -y -qq libasound2-dev libchafa-dev
-      - name: Clone tuie
+      # Pinned fork on our Gitea (rgb patch committed there) — upstream HEAD
+      # must never decide whether our build passes.
+      - name: Clone tuie (pinned fork)
         run: |
-          git clone --depth 1 https://github.com/jake-stewart/tuie.git /workspace/Fimeg/tuie
+          git clone "${GITHUB_SERVER_URL}/Fimeg/tuie.git" /workspace/Fimeg/tuie
-          sed -i 's/pub(crate) mod rgb/pub mod rgb/' /workspace/Fimeg/tuie/src/util/mod.rs
+          git -C /workspace/Fimeg/tuie checkout aa43e335c8f5a3cd2c78e397a1a8dfe534a6bc35
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
         with:
           toolchain: "1.94"
@@ -76,6 +78,73 @@ jobs:
           fi
           echo "All action refs are SHA-pinned."
 
+  # Phone artifact on green. Runs on the ArchDev build node (host mode, label
+  # archdev) where the aarch64 sysroot lives — no docker, no node, plain shell.
+  # Publishes the cross-built binary to a rolling `edge` prerelease; the phone
+  # updates itself from there instead of waiting on a laptop scp.
+  aarch64-artifact:
+    runs-on: archdev
+    needs: [rust-test, no-ai-attribution, action-pins]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/public'
+    steps:
+      - name: Clone repo + pinned tuie
+        run: |
+          set -euo pipefail
+          rm -rf "$GITHUB_WORKSPACE/src"
+          git clone "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" "$GITHUB_WORKSPACE/src/Souveraine"
+          git -C "$GITHUB_WORKSPACE/src/Souveraine" checkout "$GITHUB_SHA"
+          git clone "${GITHUB_SERVER_URL}/Fimeg/tuie.git" "$GITHUB_WORKSPACE/src/tuie"
+          git -C "$GITHUB_WORKSPACE/src/tuie" checkout aa43e335c8f5a3cd2c78e397a1a8dfe534a6bc35
+
+      - name: Cross-compile aarch64
+        run: |
+          set -euo pipefail
+          cd "$GITHUB_WORKSPACE/src/Souveraine"
+          export PKG_CONFIG_ALLOW_CROSS=1
+          export PKG_CONFIG_LIBDIR="$HOME/aarch64-sysroot/usr/lib/pkgconfig"
+          export PKG_CONFIG_SYSROOT_DIR="$HOME/aarch64-sysroot"
+          export CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc
+          # Without --sysroot the cross gcc's default sysroot (/usr/aarch64-linux-gnu,
+          # sparse) has no libmvec, so the linker falls back to the host x86_64 one
+          # and fails. Point it at the full chroot sysroot where aarch64 libmvec lives.
+          export CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_RUSTFLAGS="-C link-arg=--sysroot=$HOME/aarch64-sysroot"
+          # Persistent target dir: fresh clones per run, warm compile cache.
+          export CARGO_TARGET_DIR="$HOME/.cache/souveraine-ci-target"
+          cargo build --release --target aarch64-unknown-linux-gnu
+          BIN="$CARGO_TARGET_DIR/aarch64-unknown-linux-gnu/release/souveraine"
+          file "$BIN" | grep -q aarch64 || { echo "built binary is not aarch64" >&2; exit 1; }
+          cp "$BIN" souveraine-aarch64
+          sha256sum souveraine-aarch64 > souveraine-aarch64.sha256
+
+      - name: Publish rolling edge prerelease
+        run: |
+          set -euo pipefail
+          cd "$GITHUB_WORKSPACE/src/Souveraine"
+          API="${GITHUB_SERVER_URL}/api/v1"
+          AUTH="Authorization: token ${{ secrets.GITHUB_TOKEN }}"
+          DESC=$(git describe --tags --always)
+
+          OLD_ID=$(curl -s -H "$AUTH" "$API/repos/${GITHUB_REPOSITORY}/releases/tags/edge" \
+            | python3 -c "import json,sys
+          try: print(json.load(sys.stdin).get('id',''))
+          except Exception: print('')")
+          if [ -n "$OLD_ID" ]; then
+            curl -s -X DELETE -H "$AUTH" "$API/repos/${GITHUB_REPOSITORY}/releases/$OLD_ID"
+            curl -s -X DELETE -H "$AUTH" "$API/repos/${GITHUB_REPOSITORY}/tags/edge"
+          fi
+
+          REL_ID=$(curl -sf -X POST -H "$AUTH" -H "Content-Type: application/json" \
+            "$API/repos/${GITHUB_REPOSITORY}/releases" \
+            -d "{\"tag_name\":\"edge\",\"target_commitish\":\"${GITHUB_SHA}\",\"name\":\"edge (${DESC})\",\"body\":\"Rolling aarch64 build of public HEAD (${GITHUB_SHA}). Built on the archdev node, published only when CI is green.\",\"prerelease\":true}" \
+            | python3 -c "import json,sys; print(json.load(sys.stdin)['id'])")
+
+          for f in souveraine-aarch64 souveraine-aarch64.sha256; do
+            curl -sf -X POST -H "$AUTH" \
+              "$API/repos/${GITHUB_REPOSITORY}/releases/${REL_ID}/assets?name=${f}" \
+              -F "attachment=@${f}" -o /dev/null
+          done
+          echo "published edge (${DESC})"
+
   # Mirror the published branch only. primary (dev) never reaches Codeberg.
   sync-codeberg:
     runs-on: ubuntu-latest