Nightly update.yml rewrote PKGBUILD then failed with pre-receive hook
declined on protected master and tags. Push chore/bump-$pkgver and open
(or reuse) a PR instead. After merge, tag-release.yml creates v$pkgver
so build.yml still attaches the package.