track the AUR package as a submodule, and document it as a release channel

[jarohen]

tl;dr

• The AUR package is now tracked in-repo as a submodule at aur/, so git submodule status says which version Arch users are actually getting.
• It was three patch releases behind — 3.5.0 while the latest tag was 3.5.3 — because nothing in the repo pointed at it. Now on 3.5.3, verified by a local makepkg build.
• Existing checkouts need one command, git submodule update --init aur. Nothing else changes for anyone not cutting a release.

Context

docs/releasing.md listed five artifacts and marked all five as published by CI. The AUR package was a sixth channel that no document mentioned and no job published, so it drifted silently — the only signal would have been an Arch user reporting a stale version.

The package builds allium from the GitHub release source tarball, so a bump is only ever "point at the new tag, refresh the checksum, build once to check". Cheap to do, and correspondingly easy to leave undone.

Usage

Existing checkouts pick the submodule up with:

git submodule update --init aur

Maintainers who intend to push to the AUR need one further step, once per checkout. .gitmodules carries the read-only HTTPS URL (see D1), so the push URL is set locally:

git -C aur remote set-url --push origin ssh://aur@aur.archlinux.org/allium-tools.git

Bumping the package after a release is six steps, written up in aur/README.md.

Decision rationale

• D1: .gitmodules uses the HTTPS clone URL, not SSH. This repo is public, and the AUR's SSH URL needs an AUR account with a registered key even to clone — so git clone --recurse-submodules would fail for every outside contributor. HTTPS on the AUR is read-only, which moves the cost onto maintainers as the extra set-url --push above: the many-reader case works by default, the few-writer case takes one command.
  • con: git submodule sync re-derives origin from .gitmodules, so the push URL has to be re-set if anyone runs it. Called out in aur/README.md next to the push step it breaks.
• D2: the AUR bump stays manual. An AUR push needs a maintainer's SSH key as a repo secret, so automating it is a question about key custody rather than about packaging. docs/releasing.md names the manual step in both the scripted and the unscripted release path instead — the manual checklist is where someone mid-release actually looks, so putting it only in the new section would have reproduced the original hole.

Out of scope

• Automating the bump in release.sh or CI — see D2.
• The 3.5.3 bump itself. It is already live on the AUR; those commits are in the submodule, not in this diff, which records only the pointer.

Test plan

• makepkg -f against the 3.5.3 tarball builds allium-tools-3.5.3-1-x86_64.pkg.tar.zst, and the packaged binary reports allium 3.5.3 (language versions: 1, 2, 3).
• Anonymous git ls-remote https://aur.archlinux.org/allium-tools.git serves the pushed commit, confirming the URL in .gitmodules resolves without credentials.