GeezerVison

Summary

The onelf job now unpacks the pinned onelf-pkgs/opus v1.6.1-1 library tree over Arch's libopus, right after the onelf-pkgs Mesa swap. It is pinned by SHA-256 per architecture, as the Mesa tree is.

Arch builds Opus with DRED, deep packet loss concealment and OSCE. Those are its neural network features, and their model weights make libopus 4,159,432 bytes. An app's bundle often carries it without using it. Blue-dove gets it through PulseAudio: libpulsecommon needs libsndfile, which needs libopus, while the app decodes Opus itself. The onelf-pkgs build leaves the three features out and keeps everything else Arch enables, custom modes included. It exports the same 105 symbols under the same soname and file name, at 424,440 bytes, and needs nothing newer than GLIBC_2.29.

This stays a draft until the next onelf release, which will join this PR as a bump of PINNED_ONELF_VERSION and its SHA-256 pins.

Measured

Blue-dove v0.1.15's release job was reproduced locally: the pinned archlinux@sha256:e43f1fd8... image, the job's packages and .github/pacman-packages.txt, both onelf-pkgs swaps, then scripts/package-onelf.sh.

In both reproduced builds, the job's own xvfb-run -a timeout 60 dist/*.onelf --smoke exits 0, and playing a WAV against a PulseAudio server in the container shows the app's sink input.