upower fork: submodule, prebuilt packaging, CI build, lock-surface charge state

- packaging/upower-souveraine submodule pinned at fork head (f18b1a4,
  souveraine/charge-type): ChargeType + PercentageTrusted on Device
- PKGBUILD.upower.prebuilt: prebuilt meson install tree, provides/
  conflicts upower, replaces stock (IgnorePkg=upower on the phone)
- ci.yml: build the fork per-arch against the aarch64 sysroot, assert
  binary arch, fold into the souveraine-{arch} pacman db
- LockSurfaceHost: charge line driven by device state, not onBattery —
  no more eternal 'Charging N%' on a topped-off pack
- docs/tasks/power-indication.md force-added past the docs/ gitignore

.gitea/workflows/ci.yml

@@ -118,6 +118,71 @@ jobs:
           cp "$BIN" souveraine-x86_64
           sha256sum souveraine-aarch64 souveraine-x86_64 > souveraine-binaries.sha256
 
+      - name: Build UPower fork (per-arch install trees)
+        run: |
+          set -euo pipefail
+          cd "$GITHUB_WORKSPACE/src/Souveraine"
+          # The fork is a git submodule of Souveraine. The runner checkout
+          # above is not recursive; clone it explicitly with the same LAN
+          # token used for tuie, pinned to the submodule's recorded commit.
+          UPOWER_URL=$(git config --file .gitmodules submodule."packaging/upower-souveraine".url)
+          UPOWER_SHA=$(git ls-tree HEAD packaging/upower-souveraine | awk '{print $3}')
+          git -c http.extraheader="Authorization: token ${{ secrets.LOCAL_GITEA_TOKEN }}" \
+            clone "$UPOWER_URL" "$GITHUB_WORKSPACE/src/upower"
+          git -C "$GITHUB_WORKSPACE/src/upower" checkout "$UPOWER_SHA"
+
+          SYSROOT="$HOME/aarch64-sysroot"
+
+          # --- x86_64: native build on the archdev host ---
+          (
+            cd "$GITHUB_WORKSPACE/src/upower"
+            meson setup build-x86_64 \
+              --prefix=/usr --sysconfdir=/etc --localstatedir=/var \
+              -Dsystemdsystemunitdir=/usr/lib/systemd/system
+            meson compile -C build-x86_64
+            DESTDIR="$GITHUB_WORKSPACE/src/upower/dest-x86_64" meson install -C build-x86_64
+          )
+          tar -C "$GITHUB_WORKSPACE/src/upower/dest-x86_64" \
+            -cf "$GITHUB_WORKSPACE/src/Souveraine/upower-tree-x86_64.tar" .
+
+          # --- aarch64: cross build against the same sysroot souveraine uses ---
+          CROSS="$GITHUB_WORKSPACE/src/upower/aarch64-cross.ini"
+          cat > "$CROSS" <<EOF
+          [binaries]
+          c = 'aarch64-linux-gnu-gcc'
+          cpp = 'aarch64-linux-gnu-g++'
+          ar = 'aarch64-linux-gnu-ar'
+          strip = 'aarch64-linux-gnu-strip'
+          pkgconfig = '$PWD/.cargo/aarch64-pkg-config'
+          [built-in options]
+          c_args = ['--sysroot=$SYSROOT']
+          cpp_args = ['--sysroot=$SYSROOT']
+          c_link_args = ['--sysroot=$SYSROOT']
+          cpp_link_args = ['--sysroot=$SYSROOT']
+          [host_machine]
+          system = 'linux'
+          cpu_family = 'aarch64'
+          cpu = 'aarch64'
+          endian = 'little'
+          EOF
+          (
+            cd "$GITHUB_WORKSPACE/src/upower"
+            PKG_CONFIG_ALLOW_CROSS=1 \
+            PKG_CONFIG_LIBDIR="$SYSROOT/usr/lib/pkgconfig" \
+            PKG_CONFIG_SYSROOT_DIR="$SYSROOT" \
+            meson setup build-aarch64 \
+              --prefix=/usr --sysconfdir=/etc --localstatedir=/var \
+              -Dsystemdsystemunitdir=/usr/lib/systemd/system \
+              --cross-file "$CROSS"
+            meson compile -C build-aarch64
+            DESTDIR="$GITHUB_WORKSPACE/src/upower/dest-aarch64" meson install -C build-aarch64
+          )
+          # Sanity: the aarch64 upowerd must actually be aarch64.
+          file "$GITHUB_WORKSPACE/src/upower/dest-aarch64/usr/lib/upowerd" \
+            | grep -q aarch64 || { echo "aarch64 upowerd is not aarch64" >&2; exit 1; }
+          tar -C "$GITHUB_WORKSPACE/src/upower/dest-aarch64" \
+            -cf "$GITHUB_WORKSPACE/src/Souveraine/upower-tree-aarch64.tar" .
+
       - name: Package and sign pacman repository
         run: |
           set -euo pipefail
@@ -149,6 +214,33 @@ jobs:
             gpg --batch --yes --local-user "$ARCHIVE_KEY" \
               --detach-sign "$ARCH_REPO/$(basename "$PKG")"
 
+            # UPower fork package — built from packaging/upower-souveraine
+            # (git submodule of the Souveraine fork of upstream upower). Built
+            # natively per-arch by the "Build UPower fork" step above into
+            # upower-tree-$ARCH.tar, then folded into the SAME per-arch pacman
+            # database so the phone installs upower-souveraine from the same
+            # edge archive it already uses for souveraine.
+            UPOWER_WORK="$WORK/upower-$ARCH"
+            mkdir -p "$UPOWER_WORK"
+            cp "upower-tree-$ARCH.tar" "$UPOWER_WORK/upower-tree.tar"
+            cp packaging/upower-souveraine/dbus/org.freedesktop.UPower.Device.xml \
+               "$UPOWER_WORK/" 2>/dev/null \
+              || cp "$GITHUB_WORKSPACE/src/upower/dbus/org.freedesktop.UPower.Device.xml" \
+                    "$UPOWER_WORK/"
+            cp packaging/arch/PKGBUILD.upower.prebuilt "$UPOWER_WORK/PKGBUILD"
+            (
+              cd "$UPOWER_WORK"
+              export SOUVERAINE_PKGVER="$PKGVER"
+              export SOUVERAINE_PKGARCH="$ARCH"
+              CARCH="$ARCH" makepkg --nodeps --noconfirm --cleanbuild
+            )
+            UPKG=$(find "$UPOWER_WORK" -maxdepth 1 -name 'upower-souveraine-*.pkg.tar.zst' -print -quit)
+            test -n "$UPKG"
+            bsdtar -tf "$UPKG" | grep -qx 'usr/lib/upowerd'
+            cp "$UPKG" "$ARCH_REPO/"
+            gpg --batch --yes --local-user "$ARCHIVE_KEY" \
+              --detach-sign "$ARCH_REPO/$(basename "$UPKG")"
+
             # Pacman databases are architecture-specific: one database cannot
             # retain two same-named, same-version packages for different
             # architectures. Keep each database and its assets distinct.