Remove stale sourcehut/.builds references and hut CLI instructions. Add tuwunel (Rust build) to AGENTS.md project structure, package types table, and security scan integration table. Replace sourcehut CI section with custom self-hosted build server description in both files.

Closes ticket e6cf86f85d5eee486db3510a603df3d035308353. check-in: 1312412427 user: andrew tags: main, trunk

Adds freshclam + source ClamAV scan in prepare() and clamscan + binary strings analysis on the compiled tuwunel binary in package(), matching the repo's security-scan pattern. check-in: 92019e9c84 user: sourcehut@lewman.us tags: main, trunk

Adds a PKGBUILD for tuwunel (Rust-based Matrix homeserver, v1.8.2) and a sourcehut CI manifest that builds, lints, and clamav-scans the package. check-in: 892a23c3f6 user: sourcehut@lewman.us tags: main, trunk

Run namcap on both PKGBUILD and the built package after every makepkg to catch dependency errors, permission issues, and other packaging problems. check-in: 2ef10c6c02 user: sourcehut@lewman.us tags: main, trunk

gitit: - Add missing source= pointing directly to Hackage tarball (was using a bash array expansion in noextract that referenced $source before it was defined) - Fix empty sha512sums=('') by setting it to SKIP with proper source URL - Clear noextract=() so makepkg extracts the tarball

crush: - Restrict arch to x86_64 only and simplify package() accordingly check-in: 9a6bb232ea user: sourcehut@lewman.us tags: main, trunk

- Add clamav to makedepends in all 9 PKGBUILDs so it installs automatically with makepkg -sic instead of requiring manual installation - Add freshclam to prepare() in every PKGBUILD to update the virus database before scanning (|| true prevents blocking if freshclam is unavailable) - Add CI configs for the 5 packages that were missing them: inxi, gitit, lyx, hw-probe, publii-appimage check-in: 1402019b3e user: sourcehut@lewman.us tags: main, trunk

Scan the complete installed output of every package() function with ClamAV, not just the input sources or binaries. This catches malware introduced during extraction or the build process itself.

Also make ClamAV unavailable a fatal build error rather than silently skipping the scan, since proceeding without malware detection defeats the purpose of the check. check-in: b4485acd95 user: sourcehut@lewman.us tags: main, trunk

Replace prose-heavy descriptions with tables, cut from ~480 to ~140 lines. Remove manual security tool details not wired into the build pipeline. Retain all actionable commands, gotchas, scan integration, and per-package guidance. check-in: 15b742cb77 user: sourcehut@lewman.us tags: main, trunk

Replace generic usage instructions with concise sourcehut-centric docs: building from src/<pkg>, CI via .builds/*.yml, and push options for skipping or selecting specific builds. check-in: f63970aae7 user: sourcehut@lewman.us tags: main, trunk

- Add crush to project structure and per-package scan table - Document multi-arch binary repackaging pattern - Add Selective CI Builds section with git push -o submit examples - Fix outdated security scanning instructions: replace source-array approach with runtime _security_scan_lib path computation check-in: f4c6c48958 user: sourcehut@lewman.us tags: main, trunk

- Add _security_scan_lib path computation and prepare() with scan_binary_repack on the downloaded tarball - Add .builds/crush.yml with clamav + freshclam for CI scanning check-in: 9bcb9d54d0 user: sourcehut@lewman.us tags: main, trunk