Drop pacman packaging, bakery-only; fix broken Tauri build path in CI

bakery.toml gains license_file/desktop_file (closing the same gap found
across the rest of the ecosystem) plus hicolor-icon-theme as an optional
dep. Removes packaging/PKGBUILD and .forgejo/workflows/package.yml.

Also fixes release.yml, which has never actually succeeded since the
GTK4->Tauri migration (93c3b88): Cargo.toml moved to src/src/Cargo.toml
(the checkout dir is conventionally named "src", and this repo's own
Rust backend directory is *also* named "src", not the usual src-tauri),
and the Rust build needs frontend/build to already exist (tauri.conf.json's
frontendDist) — that's normally handled by `cargo tauri build`'s
beforeBuildCommand hook, which a plain `cargo build` never runs, so it's
now a separate explicit "build frontend" step. Adds dev-release.yml/
beta-release.yml for the same three-track policy used ecosystem-wide.

.forgejo/workflows/release.yml

@@ -15,8 +15,23 @@ jobs:
           git clone --branch "${GITHUB_REF_NAME}" --depth 1 \
             "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
 
+      # bos-settings is a Tauri app: Cargo.toml lives at src/src/Cargo.toml
+      # (checkout root is named "src" by convention above; the repo's own
+      # Rust backend is also in a dir called "src", not the usual
+      # src-tauri — hence src/src below), and the Rust build expects the
+      # frontend already built at frontend/build (tauri.conf.json's
+      # frontendDist) — that only happens automatically under `cargo
+      # tauri build`, so it's run explicitly here since this workflow
+      # just uses plain `cargo build`.
+      - name: build frontend
+        run: |
+          set -euo pipefail
+          cd src/frontend
+          npm ci
+          npm run build
+
       - name: build
-        run: cd src && cargo build --release --locked
+        run: cd src/src && cargo build --release --locked
 
       - name: prepare artifacts
         run: |
@@ -24,19 +39,29 @@ jobs:
           VERSION="${GITHUB_REF_NAME#v}"
           PKG_DIR="/srv/breadway-dl/bos-settings/${VERSION}"
           mkdir -p "${PKG_DIR}"
-          cp "src/target/release/bos-settings" "${PKG_DIR}/bos-settings-x86_64"
+          cp "src/src/target/release/bos-settings" "${PKG_DIR}/bos-settings-x86_64"
           strip "${PKG_DIR}/bos-settings-x86_64"
           sha256sum "${PKG_DIR}/bos-settings-x86_64" | awk '{print $1}' \
             > "${PKG_DIR}/bos-settings-x86_64.sha256"
+          cp src/packaging/bos-settings.desktop "${PKG_DIR}/"
+          cp src/LICENSE "${PKG_DIR}/"
           cp src/bakery.toml "${PKG_DIR}/bakery.toml"
           ln -sfn "${VERSION}" "/srv/breadway-dl/bos-settings/latest"
 
       - name: regenerate index.json
+        env:
+          MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
         run: |
           set -euo pipefail
-          rm -rf /tmp/bread-ecosystem-ci
-          git clone https://git.breadway.dev/Breadway/bread-ecosystem.git /tmp/bread-ecosystem-ci
-          bash /tmp/bread-ecosystem-ci/scripts/gen-index.sh
+          if [ -z "${MINISIGN_SEC_KEY:-}" ]; then
+            echo "::error::BAKERY_MINISIGN_SEC_KEY_PATH secret not set — refusing to regenerate index.json unsigned (would leave a stale signature mismatched against fresh content and break bakery for everyone)"
+            exit 1
+          fi
+          rm -rf /tmp/bread-ecosystem-ci-* 2>/dev/null || true
+          ECOSYSTEM_CI_DIR="$(mktemp -d /tmp/bread-ecosystem-ci-XXXXXX)"
+          git clone https://git.breadway.dev/Breadway/bread-ecosystem.git "${ECOSYSTEM_CI_DIR}"
+          bash "${ECOSYSTEM_CI_DIR}/scripts/gen-index.sh"
+          rm -rf "${ECOSYSTEM_CI_DIR}"
 
       - name: upload to GitHub Release
         env: