ci: the family's build pipeline, and PKGVER by export

Brings this manifest to the shape the sibling services share.

cacher is installed by install.sh instead of a raw curl of the binary, in
two tasks: install.sh appends its PATH export to ~/.buildenv, which only
the next task sources. The old fetch had no -f, so an HTTP error body was
written to ~/.local/bin/cacher and chmod +x'd; the installer verifies
against checksums.txt.

The version task drops the sed of the tracked APKBUILD. Measured on
go1.26.5, rewriting a tracked file sets vcs.modified=true and Go stamps
+dirty into Main.Version for the whole abuild run, so PKGVER is exported
and APKBUILD reads pkgver="${PKGVER:-0.0.0}". One git describe decides
it: the tag, the tag plus commits, or the commit count. Tags join
allow-refs so pushing v0.9.0 produces the 0.9.0 apk. The export alone is
not enough — abuild works inside the checkout and puts src/, pkg/ and
GOTMPDIR=tmp/ there, so .gitignore covers all three.

cache_restore takes --optional rather than || true, which also swallowed
bad credentials and a dead bucket, and gains the half-restored module
cache repair block. cache_save moves after publish so an S3 hiccup cannot
strand a good apk, and loses its cacher exists guards: dir upload already
skips a present key. publish gains the no-credentials gate.

The stylesheet is now built in CI: sassc and minify, the scss task that
materializes the shared partials no apk ships, make css before the
compile and make check-css after it. The committed
web/static/main.min.79713f25.css stays tracked for now — build() prints
git status and the digest so the first CI run says whether the pipeline
reproduces those bytes, and dropping it from the index is a second step.

package() calls make install-files. abuild runs it in a fresh process
that never called build(), so make install would relink the binary from a
cold cache and ship a compilation nothing had checked.

Reasoning lives in docs/ci.md: the manifest is a varchar(16384) and a
branch over the cap gets no CI at all

web: content-hash the bundle and colour the status column

Two diff-view fixes reported against the deployed instance.

Empty file tree after an upgrade: bundle.js had a stable filename served with a
1-hour cache, so browsers kept a pre-fix bundle and the @pierre/trees sidebar
rendered blank. Content-hash the bundle like the stylesheet — Makefile emits
bundle.<sha256[:8]>.js, server.go globs it into a BundleHref, the templates
reference {{.BundleHref}}, and the hashed name is served immutable. A deploy now
always busts the cache.

Unreadable status column: the changed-files table rendered A/M/D in the dim
default cell colour, near-invisible on the dark chrome. Render each status as a
semantic .diff-status badge (added=green, modified=amber, deleted=red,
renamed=blue) with light/dark variants, via statusClass/statusLabel helpers and
a small self-contained style block (the sourcehut-derived main.min.css can't be
rebuilt locally).

Tests resolve the hashed bundle via a bundleName helper and assert its immutable
cache header; docs updated for the hashed filename.

cmd/comparesrht: daemon entry point, startup validation, dev stub

Wire the compare.sr.ht daemon on core-go's server.New: it runs
crypto.InitCrypto, parses -b/-d/-m/-p, and drives the standard SourceHut
warm-shutdown loop (SIGINT). We deliberately skip WithDefaultMiddleware
(it demands Postgres/Redis and 401s anonymous viewers) and instead
install the web package's documented middleware chain — RealIP, Recoverer,
Logger, config.Middleware, authz.Middleware — inside a Group on the
anonymous router.

validateConfig checks every required key up front (network-key, webhook
key, repos root, a git.sr.ht API origin candidate, meta and compare
origins) with a single clear fatal, so a misconfiguration fails loudly at
startup rather than as a deep panic in config.GetAPI on the first request.

A build-and-exec smoke test proves the binary starts against a synthesized
config, answers /healthz 200, and exits cleanly on SIGINT in under 15s.

Makefile: build ./comparesrht from ./cmd/comparesrht, run-dev binds
localhost:5090 against a local config.ini, install ships the binary and
static assets. contrib/dev-stub is a stdlib-only fake git.sr.ht GraphQL
API returning fixed public repos for local development, and the systemd
unit now stops with KillSignal=SIGINT to hit the warm-shutdown path.

frontend: pierre diffs/trees bundle and sourcehut theme css

Vendored esbuild bundle (frontend/src/app.ts) rendering @pierre/diffs
FileDiff per file and a @pierre/trees FileTree sidebar against the SSR
#compare-data contract, plus scss/main.scss (base + compare views)
compiled and content-hashed into web/static/.

compare.sr.ht: project foundation — core package, build scaffolding, core-go fork pin

Bootstrap the go.bigb.es/sourcehut-compare service:

- go.mod (go 1.26.4) pinning core-go to the private fork
  git.srht.bigb.es/~bigbes/core-go @ c2c2f3848fa9 via a replace directive;
  go.sum populated by a throwaway smoke build importing core-go
  config/crypto/client/server + chi + logrus (gates API drift from the
  verification baseline fdb3662 to upstream 71b2787).
- core/: pure domain package — sentinel errors, owner/repo/ref validation
  (check-ref-format-style, hostile-input hardened), and the compare-spec
  grammar (ParseCompareSpec, three-dot/two-dot, percent-unescape). Table
  tests at 97% coverage.
- Makefile (all/build/test/css/bundle/run-dev/install), config.example.ini
  documenting the shared keys read in place, contrib/ nginx block and
  systemd unit, README skeleton, .gitignore.

core-go dep deps and go mod tidy are deferred to later phases per plan.