ci: publish the apk into artifacts.sr.ht as well

The abuild output goes on to the S3 bucket phoebe re-indexes, and now also to
the ~bigbes/main channel of artifacts.sr.ht, which indexes and signs it in the
same request. One PUT per file with the shared working token; a 409 says the
job ran twice and is a warning rather than a failure.

rename the service to diff.sr.ht

The instance-facing name changes and nothing else does: the config.ini section,
the origin, the apk package, the nginx block and the systemd unit are all
diff.sr.ht now, and the brand's red service label reads "diff" because chrome
derives it from the section name.

What deliberately stays is everything whose rename would cost more than it is
worth: the Go module path, the repository name, the comparesrht binary, and the
/~owner/repo/compare/base...head routes people have in their history. README
says so at the top so the split is not read as an oversight.

ci: drop the 'all' from go mod download, which rewrote go.sum

The cache warm-up was 'go mod download all'. That resolves the entire
module graph, test dependencies of dependencies included, and appends
their hashes to go.sum — 145 lines in this repository, measured in a
fresh clone of this branch.

Which makes it the bug this wave exists to remove. A modified tracked
file in the checkout when go build runs is what stamps vcs.modified into
the binary, the same failure the version task avoids by not sed-ing the
APKBUILD; the warm-up would have reintroduced it one task later. The
bench sibling proved it first: build #359 stopped at check-version with
a -dirty binary and 'M go.sum' named as the thing in the way, 228 lines
there.

Without 'all' go.sum is untouched, go mod verify still passes, and what
is fetched is what the main module builds, which is all a warm-up needs.

Also removes the sentence that let this through. Both the manifest and
docs/ci.md claimed -mod=readonly is the default so neither command can
rewrite go.mod or go.sum. It is false, and it sat directly above the
line that disproved it. readonly governs updates to the module
requirements, not writes to go.sum: measured here with the flag set
explicitly on the command line, 'go mod download all' still appends the
same 145 lines and still exits 0, and go mod verify passes after it, so
verification guards nothing either.

Setting the flag on the command line is the point. This machine carries
go env -w GOFLAGS=-mod=mod, as bench's did, so a run that omits it
proves nothing about the builder.

What remains is the git status --porcelain at the end of the task, and
it is now documented as the check rather than as belt-and-braces: it is
the only thing that would notice a go.sum rewrite before the compile,
and on bench it is what did. docs/ci.md warns against restoring the
'all' and against replacing the print with an appeal to a flag.

compare's README makes no claim about module hygiene in CI, so nothing
to correct there

ci: a test task, and the truth about !check

gofmt, go vet and make test, between cache_restore and build. gofmt -l
exits 0 whether or not it printed anything, so its output goes through
tee and is checked with test -s.

No Postgres and no network: every suite here is hermetic, so nothing can
skip and there is no DSN to guard. gitx/fixture_test.go builds a bare
repository with the local git and web/web_test.go is httptest plus
ecoretest.

Which makes the APKBUILD's !check comment wrong, and it has been wrong
the whole time — the tests never needed a live git.sr.ht API. With the
task in place the option stops meaning 'these cannot run here' and starts
meaning 'these ran before abuild did', which is only true while make test
stays fatal. Said so where the option is.

ci: the family's build pipeline, and PKGVER by export

Brings this manifest to the shape the sibling services share.

cacher is installed by install.sh instead of a raw curl of the binary, in
two tasks: install.sh appends its PATH export to ~/.buildenv, which only
the next task sources. The old fetch had no -f, so an HTTP error body was
written to ~/.local/bin/cacher and chmod +x'd; the installer verifies
against checksums.txt.

The version task drops the sed of the tracked APKBUILD. Measured on
go1.26.5, rewriting a tracked file sets vcs.modified=true and Go stamps
+dirty into Main.Version for the whole abuild run, so PKGVER is exported
and APKBUILD reads pkgver="${PKGVER:-0.0.0}". One git describe decides
it: the tag, the tag plus commits, or the commit count. Tags join
allow-refs so pushing v0.9.0 produces the 0.9.0 apk. The export alone is
not enough — abuild works inside the checkout and puts src/, pkg/ and
GOTMPDIR=tmp/ there, so .gitignore covers all three.

cache_restore takes --optional rather than || true, which also swallowed
bad credentials and a dead bucket, and gains the half-restored module
cache repair block. cache_save moves after publish so an S3 hiccup cannot
strand a good apk, and loses its cacher exists guards: dir upload already
skips a present key. publish gains the no-credentials gate.

The stylesheet is now built in CI: sassc and minify, the scss task that
materializes the shared partials no apk ships, make css before the
compile and make check-css after it. The committed
web/static/main.min.79713f25.css stays tracked for now — build() prints
git status and the digest so the first CI run says whether the pipeline
reproduces those bytes, and dropping it from the index is a second step.

package() calls make install-files. abuild runs it in a fresh process
that never called build(), so make install would relink the binary from a
cold cache and ship a compilation nothing had checked.

Reasoning lives in docs/ci.md: the manifest is a varchar(16384) and a
branch over the cap gets no CI at all

login: ecore's cookie decoder, which validates the name ours did not

authz/identity.go was the fifth copy of a decode the instance has one of,
and it was one of the two that validated nothing: whatever name a sealed
payload carried went on to the GraphQL viewer field, the chrome's nav and
every log line the request produced. login.ValidName refuses it, and
there is no spelling of the API that turns the check off.

Gone with it: CookieName, UsernameFromRequest, Middleware, ForContext and
the ctxKey, plus identity_test.go, whose round-trip, tilde-stripping and
garbage-cookie cases are ecore's tests now. The Middleware becomes
login.Optional() — this service refuses nobody, git.sr.ht decides what an
anonymous viewer may see — and the default validator is kept rather than
core.ValidOwner, which is lowercase-only and would log a real account out
of compare alone.

The one behaviour change a viewer could notice: a cookie whose name
carries a '/', a control byte or a non-ASCII letter now reads as
anonymous instead of as that name.

docs: spec for inline code comments on diffs

Draft proposal for line-anchored comment threads on the commit and compare
pages. Records the key finding that storage is already available through
sr-ht-core (Postgres via the database package + connection-string), that the
service is stateless by choice rather than by limitation, and that @pierre/diffs
already provides the thread UI primitives (DiffLineAnnotation + renderAnnotation
+ onDiffLineClick). Covers the anchoring model, schema, authz reuse, HTTP API,
frontend wiring, config, and a commit-first phasing.