packaging: republish python-pywal to [breadway]

python-pywal was dropped from Arch's [extra] repo (AUR-only now), so
`pacstrap` can no longer resolve it and every ISO build fails with
"target not found: python-pywal". The `wal` binary is load-bearing —
bread-theme shells out to it to extract the colour palette from the
user's wallpaper.

Republish it the same way as calamares / bibata / powerlevel10k /
yay-bin:

- `packaging/python-pywal/PKGBUILD` — in-house copy of the AUR PKGBUILD
  (Morten Linderud's), modernised to `python -m build` / `installer`
  instead of the removed `setup.py install`, sha256-only sources like
  the sibling PKGBUILDs. Test-built locally: 28 unit tests pass, package
  ships `/usr/bin/wal`.
- `.forgejo/workflows/python-pywal.yml` — builds + PUTs to the Forgejo
  Arch registry on a push to `packaging/python-pywal/**`.
- `signed-repo.yml` gains it as a `workflow_run` trigger;
  `ci-publish-signed-repo.sh` gains it in `PACKAGES` so the signed
  dl.breadway.dev/arch db picks it up.
- packages.x86_64 keeps the `python-pywal` line (now sourced from
  [breadway]) with a note.

Ordering: `python-pywal.yml` must publish to the registry once before
`signed-repo.yml` runs, or the collect step errors "registry db missing
packages: python-pywal".

.forgejo/workflows/python-pywal.yml

@@ -0,0 +1,39 @@
+name: Build and publish python-pywal
+
+# python-pywal was dropped from Arch's [extra] repo (AUR-only now), but the ISO
+# needs the `wal` binary (bread-theme extracts the wallpaper palette with it).
+# BOS keeps an in-house PKGBUILD and publishes to the [breadway] repo — same
+# pattern as calamares / bibata / powerlevel10k / yay-bin.
+on:
+  push:
+    paths:
+      - 'packaging/python-pywal/**'
+  workflow_dispatch:
+
+jobs:
+  python-pywal:
+    runs-on: [self-hosted, hestia]
+    container:
+      image: archlinux:latest
+    steps:
+      - name: Build and publish
+        env:
+          PUBLISH_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -euo pipefail
+          pacman -Syu --noconfirm base-devel git \
+            python python-build python-installer python-wheel python-setuptools imagemagick
+          useradd -m builder
+          git config --global --add safe.directory '*'
+          # Clone the ref that triggered this run (not the default branch) —
+          # same as the other packaging workflows.
+          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
+            "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" /home/builder/src
+          chown -R builder:builder /home/builder/src
+          su builder -c "cd /home/builder/src/packaging/python-pywal && makepkg -f --noconfirm"
+          PKG=$(find /home/builder/src/packaging/python-pywal -name '*.pkg.tar.zst' | head -1)
+          curl -fsS -X PUT \
+            -H "Authorization: token ${PUBLISH_TOKEN}" \
+            -H "Content-Type: application/octet-stream" \
+            --data-binary "@${PKG}" \
+            "https://git.breadway.dev/api/packages/Breadway/arch/os"