aur: install fips-dns helpers, fix fips/fips-git package transition

The AUR `fips` and `fips-git` packages did not install the
`fips-dns-setup` and `fips-dns-teardown` helper scripts that
`fips-dns.service` runs. The Debian package ships them to
`/usr/lib/fips/` through the `[package.metadata.deb]` assets, but the
AUR `package()` functions never replicated those install steps, so
`fips-dns.service` failed to start on Arch with "Unable to locate
executable /usr/lib/fips/fips-dns-setup".

Add the two `install -Dm0755` lines to both PKGBUILDs so the AUR
packages match the Debian layout.

Also harden the transition between the `fips` and `fips-git`
packages: each PKGBUILD now declares the other variant's `-debug`
split package as a conflict and opts out of the debug split, so a
stale debug build cannot retain ownership of installed files when
switching between the release and VCS packages. The `aur-publish`
workflow gains a validated `pkgrel` dispatch input so corrected
packaging can be republished against an existing release tag without
retagging.

Fixes #98

(cherry picked from commit 4cf550e23d)

CHANGELOG.md

@@ -60,6 +60,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- AUR packaging: the `fips` and `fips-git` PKGBUILDs now install the
+  `fips-dns-setup` and `fips-dns-teardown` helpers into
+  `/usr/lib/fips/`, matching the Debian package. The AUR `package()`
+  step previously omitted them, so `fips-dns.service` failed to
+  start on Arch installs ("Unable to locate executable
+  `/usr/lib/fips/fips-dns-setup`", #98). The PKGBUILDs additionally
+  opt out of the debug split package and declare the `*-debug`
+  variant as a conflict, so a stale debug build cannot own installed
+  files across a package switch.
 - Nostr discovery: filter unroutable direct UDP/TCP advert endpoints.
   Publisher and validator now retain only endpoints that parse as
   concrete socket addresses with routable IPs and nonzero ports.