patches: core-go-checksum — fix the actual sigv4 bug, not flexible-checksums

The previous version of the patch set RequestChecksumCalculation=WhenRequired,
which targeted the flexible-checksum middleware. That layer never causes the
seek; the bug is in the sigv4 dynamic-payload middleware, which only uses
UnsignedPayload over HTTPS. With s3-insecure=true to internal Garage the
SDK takes the ComputePayloadSHA256 branch and seeks the non-seekable body.

Updated patch:
- Swaps ComputePayloadHash middleware for v4.UnsignedPayload{} via
  opts.APIOptions in objects.NewClient — forces unsigned payload regardless
  of TLS.
- Adds s3.WithSigV4SigningRegion(region) to NewFromConfig so the V1 endpoint
  resolver can't override the signing region back to "default".

Mirrors phoebe-lab/srht/patches/core-go-checksum.patch (d8feacd).

docs(sourcehut-ci): fix factual errors found in full audit

Verified the skill against the actual upstream sources mirrored in this
workspace and fixed every concrete claim that didn't match the code:

- Secrets management URL is builds.sr.ht/secrets, not meta.sr.ht/secrets
  (route lives in builds.sr.ht/buildsrht/blueprints/secrets.py; meta has
  no /secret* route). Updated SKILL.md, manifest.md, secrets-and-oauth.md.

- SSH key secret installation path: the worker uses the manifest entry
  verbatim, so name references land at ~/.ssh/<name>, not ~/.ssh/<uuid>
  (builds.sr.ht/worker/tasks.go SendSecrets).

- ubuntu/lts now points to resolute (26.04 LTS); oldlts points to noble.
  Added jammy and questing to the shipped-versions list.

- hut todo subcommands: rewrote the block to match v0.8.0 — `create` and
  `comment` only accept --stdin (no -t/-s/-b), `update-status` (not
  `update`), `list` reads --tracker (persistent flag on `hut todo`).

- hut pages acl update --id is required (MarkFlagRequired in
  hut/pages.go), not optional.

Add sourcehut-ci skill backup and justfile install target

Mirror the live ~/.claude/skills/sourcehut-ci skill into skills/ and add an
rsync-based 'install' recipe (repo -> ~/.claude).

Add BSD 2-Clause license for original workspace files

Scoped to the helper scripts, skills, generated index, patches, and docs
authored here; upstream submodules keep their own licenses.

fix: build-index.sh — accept .git gitlinks, not just directories

After `git submodule absorbgitdirs`, each subproject's worktree contains
a .git *file* pointing into .git/modules/<name>/, not a .git directory.
The old `find -type d` test silently skipped every submodule, leaving
INDEX.md empty of repo content. Widen the type filter to both files and
directories so submodule-backed clones are detected too.

docs: document the new hut submodule

Updates CLAUDE.md (workspace layout) and the sourcehut-refresh skill to
explain that hut lives at ~xenrox, won't be discovered by the upstream
scrape, and must be bumped manually. INDEX.md timestamp bump.

add hut CLI from ~xenrox as a tracked submodule (v0.8.0)

hut lives outside the ~sircmpwn umbrella but is the de-facto SourceHut
CLI, so it's worth mirroring alongside the rest. Noted in CLAUDE.md and
called out in sourcehut-refresh that the scrape won't find it — it must
be bumped manually.

patches: ubuntu/genimg — move guest DNS override to end of script

patches: ubuntu/genimg — fix guest DNS (SLIRP proxy) and -p1 hint

patches: ubuntu/genimg — correct context lines for the network hunk

The previous version had stale context (EOF / fi / DHCP=yes) that didn't
match the actual recipe. Replace with the real surrounding lines (resolv.conf
nameservers above, Address=10.0.2.15/24 below) so `patch -p0` applies
cleanly on a fresh apk recipe tree.

patches: ubuntu/genimg — widen systemd-networkd match to Name=en*

Third hunk in the ubuntu/genimg patch. Upstream only writes
25-ens3.network matching Name=ens3, but on modern noble + virtio the
kernel names the interface enp0s3 instead, so DHCP never starts and
the build-worker times out in 'Waiting for guest to settle'. Rename
the file to 25-ethernet.network and broaden [Match] Name= to en*.

patches: track ubuntu/genimg nbd-settle and chroot-chown fixes

Two-bug patch against builds.sr.ht-images ubuntu/genimg, applied
out-of-band on work.lab.local but not yet upstreamed to sr.ht-dev.

init: superproject for SourceHut documentation mirror

29 upstream SourceHut repos pinned as submodules to their latest tags,
plus Claude tooling (skills, build-index script, INDEX inventory) and
phoebe-lab production patches that are not yet upstream.

Read CLAUDE.md and .claude/INDEX.md before exploring.