aur: install fips-dns helpers, fix fips/fips-git package transition

The AUR `fips` and `fips-git` packages did not install the
`fips-dns-setup` and `fips-dns-teardown` helper scripts that
`fips-dns.service` runs. The Debian package ships them to
`/usr/lib/fips/` through the `[package.metadata.deb]` assets, but the
AUR `package()` functions never replicated those install steps, so
`fips-dns.service` failed to start on Arch with "Unable to locate
executable /usr/lib/fips/fips-dns-setup".

Add the two `install -Dm0755` lines to both PKGBUILDs so the AUR
packages match the Debian layout.

Also harden the transition between the `fips` and `fips-git`
packages: each PKGBUILD now declares the other variant's `-debug`
split package as a conflict and opts out of the debug split, so a
stale debug build cannot retain ownership of installed files when
switching between the release and VCS packages. The `aur-publish`
workflow gains a validated `pkgrel` dispatch input so corrected
packaging can be republished against an existing release tag without
retagging.

Fixes #98

(cherry picked from commit 4cf550e23d)

packaging/aur/PKGBUILD

@@ -9,7 +9,7 @@ arch=('x86_64')
 depends=('gcc-libs' 'glibc')
 makedepends=('cargo')
 optdepends=('systemd-resolved: .fips DNS resolution')
-conflicts=('fips-git')
+conflicts=('fips-git' 'fips-git-debug')
 backup=('etc/fips/fips.yaml' 'etc/fips/hosts' 'etc/fips/fips.nft')
 install=fips.install
 source=("$pkgname-$pkgver.tar.gz::https://github.com/jmcorgan/fips/archive/v$pkgver.tar.gz"
@@ -18,7 +18,7 @@ source=("$pkgname-$pkgver.tar.gz::https://github.com/jmcorgan/fips/archive/v$pkg
 b2sums=('SKIP'  # tarball hash computed by CI via updpkgsums on release
         '25a0552f3d67d12f48dfd40fe4776ad7c46afeeab76bd2674b48e234db3c145810a24569a8c1a7f4c186eb546f0fae2ebe1550080c0e91d8eb72ba9934c752a6'
         '844257cb8e09cd935d0d6345922d0f3ec777411daca20e24175b346a7b3cb95ebce12631a9466c4d94f1588ed8d62d92514ff24025ccfd0efb358e542b454b00')
-options=('!lto')
+options=('!lto' '!debug')
 
 prepare() {
     cd "$pkgname-$pkgver"
@@ -53,6 +53,10 @@ package() {
     install -Dm0644 packaging/debian/fips-gateway.service "$pkgdir/usr/lib/systemd/system/fips-gateway.service"
     install -Dm0644 packaging/debian/fips-firewall.service "$pkgdir/usr/lib/systemd/system/fips-firewall.service"
 
+    # DNS helper scripts referenced by fips-dns.service
+    install -Dm0755 packaging/common/fips-dns-setup "$pkgdir/usr/lib/fips/fips-dns-setup"
+    install -Dm0755 packaging/common/fips-dns-teardown "$pkgdir/usr/lib/fips/fips-dns-teardown"
+
     # Config files (from packaging/common/)
     install -Dm0600 packaging/common/fips.yaml "$pkgdir/etc/fips/fips.yaml"
     install -Dm0644 packaging/common/hosts "$pkgdir/etc/fips/hosts"

packaging/aur/PKGBUILD-git

@@ -10,7 +10,7 @@ depends=('dbus' 'gcc-libs' 'glibc')
 makedepends=('cargo' 'git')
 optdepends=('systemd-resolved: .fips DNS resolution')
 provides=('fips')
-conflicts=('fips')
+conflicts=('fips' 'fips-debug')
 backup=('etc/fips/fips.yaml' 'etc/fips/hosts' 'etc/fips/fips.nft')
 install=fips.install
 source=("fips::git+https://github.com/jmcorgan/fips.git"
@@ -60,6 +60,10 @@ package() {
     install -Dm0644 packaging/debian/fips-gateway.service "$pkgdir/usr/lib/systemd/system/fips-gateway.service"
     install -Dm0644 packaging/debian/fips-firewall.service "$pkgdir/usr/lib/systemd/system/fips-firewall.service"
 
+    # DNS helper scripts referenced by fips-dns.service
+    install -Dm0755 packaging/common/fips-dns-setup "$pkgdir/usr/lib/fips/fips-dns-setup"
+    install -Dm0755 packaging/common/fips-dns-teardown "$pkgdir/usr/lib/fips/fips-dns-teardown"
+
     # Config files (from packaging/common/)
     install -Dm0600 packaging/common/fips.yaml "$pkgdir/etc/fips/fips.yaml"
     install -Dm0644 packaging/common/hosts "$pkgdir/etc/fips/hosts"

packaging/aur/README.md

@@ -31,6 +31,8 @@ package:
 - Binaries: `fips`, `fipsctl`, `fipstop`, `fips-gateway`
 - Systemd units: `fips.service`, `fips-dns.service`, `fips-gateway.service`,
   `fips-firewall.service`
+- DNS helpers: `/usr/lib/fips/fips-dns-setup`,
+  `/usr/lib/fips/fips-dns-teardown`
 - Config: `/etc/fips/fips.yaml`, `/etc/fips/hosts`, `/etc/fips/fips.nft`
 - sysusers/tmpfiles fragments for the `fips` group and `/run/fips/`
 
@@ -39,6 +41,11 @@ operator edits to the nftables ruleset survive package upgrades.
 `fips-firewall.service` is shipped disabled by default, matching the Debian
 package: operators opt in by enabling it explicitly.
 
+Both PKGBUILDs opt out of makepkg's automatic `*-debug` split packages. The
+package metadata still conflicts with stale peer debug package names
+(`fips-debug` / `fips-git-debug`) so switching between release and development
+variants removes old debug-file owners cleanly.
+
 ## Local Build and Validation
 
 Build and validate the `-git` package locally using the Makefile target:
@@ -321,3 +328,8 @@ Push an update when a new version is tagged. The steps are:
 
 Phase 4 CI automation will handle this workflow automatically on new GitHub
 releases.
+
+For a packaging-only republish of an existing release tag, run the AUR Publish
+workflow manually with the existing tag and incremented `pkgrel` (for example,
+`tag=v0.3.0`, `pkgrel=2`). This keeps the upstream source tarball unchanged
+while forcing AUR helpers to rebuild with the corrected package metadata.