pkgbuild: Install auto-update launch shim

Replace the /usr/bin/grok-bot (and sand) plain symlink with a launch
shim that checks the latest Gitea release, pacman -U's a newer
.pkg.tar.zst when available, then execs the real binary under
/opt/Grok Bot/. Skip with GROK_BOT_NO_UPDATE=1; fail soft on
network/API errors. Bump pkgrel for the packaging change.

#2

grok-bot-launch.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# Launch shim for grok-bot-bin: optionally auto-update from Gitea releases, then
+# exec the real binary under /opt/Grok Bot/. Fail soft on network/API errors.
+set -u
+
+REAL_DIR="/opt/Grok Bot"
+API_URL='https://git.s1d3sw1ped.com/api/v1/repos/s1d3sw1ped/grok-bot-bin/releases?limit=1'
+
+_maybe_update() {
+  [[ "${GROK_BOT_NO_UPDATE:-}" == "1" ]] && return 0
+  command -v curl >/dev/null 2>&1 || return 0
+  command -v pacman >/dev/null 2>&1 || return 0
+  command -v vercmp >/dev/null 2>&1 || return 0
+
+  local installed
+  installed=$(pacman -Q grok-bot-bin 2>/dev/null | awk '{print $2}') || return 0
+  [[ -n "$installed" ]] || return 0
+
+  local json
+  json=$(curl -fsSL --connect-timeout 3 --max-time 10 "$API_URL" 2>/dev/null) || return 0
+  [[ -n "$json" ]] || return 0
+
+  local asset_url asset_name remote_ver
+  asset_url=$(grep -oE 'https://[^"[:space:]\\]+grok-bot-bin-[^"[:space:]\\]+\.pkg\.tar\.zst' <<<"$json" | head -1) || true
+  [[ -n "$asset_url" ]] || return 0
+  asset_name=$(basename "$asset_url")
+  if [[ "$asset_name" =~ ^grok-bot-bin-(.+)-x86_64\.pkg\.tar\.zst$ ]]; then
+    remote_ver="${BASH_REMATCH[1]}"
+  else
+    return 0
+  fi
+
+  # Only upgrade when remote is strictly newer (vercmp: 1 means a > b).
+  local cmp
+  cmp=$(vercmp "$remote_ver" "$installed" 2>/dev/null) || return 0
+  [[ "$cmp" =~ ^-?[0-9]+$ ]] || return 0
+  if (( cmp <= 0 )); then
+    return 0
+  fi
+
+  local tmpdir pkg
+  tmpdir=$(mktemp -d 2>/dev/null) || return 0
+  # shellcheck disable=SC2064
+  trap "rm -rf '$tmpdir'" RETURN
+  pkg="$tmpdir/$asset_name"
+
+  echo "grok-bot: updating grok-bot-bin ${installed} -> ${remote_ver}" >&2
+  if ! curl -fL --connect-timeout 5 --max-time 600 -o "$pkg" "$asset_url" 2>/dev/null; then
+    echo "grok-bot: download failed; launching installed version" >&2
+    return 0
+  fi
+
+  # Prefer passwordless sudo; fall back to interactive sudo. Fail soft either way.
+  if ! sudo -n pacman -U --noconfirm "$pkg" 2>/dev/null; then
+    if ! sudo pacman -U --noconfirm "$pkg"; then
+      echo "grok-bot: pacman -U failed; launching installed version" >&2
+      return 0
+    fi
+  fi
+}
+
+_maybe_update || true
+trap - RETURN
+
+if [[ -x "${REAL_DIR}/grok-bot" ]]; then
+  exec "${REAL_DIR}/grok-bot" "$@"
+elif [[ -x "${REAL_DIR}/sand" ]]; then
+  exec "${REAL_DIR}/sand" "$@"
+else
+  echo "grok-bot: real binary not found under ${REAL_DIR}" >&2
+  exit 127
+fi