fix: correct binary resolution, per-host side files, and index noise

[QaidVoid]

Five fixes to index generation, found while installing the tree package by package. Two of them were shipping wrong or unusable binaries.

An archive holding several architectures installed the wrong one

strip_archive_root dropped the leading path component unconditionally, so broot's x86_64-unknown-linux-musl/broot was published as bare broot. Its zip carries nine architectures, each under its own directory, so the client matched on filename and picked one arbitrarily. On an x86_64 host that meant:

broot-broot-776076224c3e/armv7-unknown-linux-gnueabihf/broot
ELF 32-bit LSB pie executable, ARM, EABI5

Install paths are now published as written. Where an archive has a single top-level directory that the client promotes away, the client retries without the leading component, so those keep working. Stripping here instead discarded the only thing telling two architectures apart.

Verified on an x86_64 host across all 28 packages whose install path leads with ${arch}, each from a fully reset root: every one resolves to an x86-64 binary. Previously broot resolved to ARM.

A desktop file stopped the actual binary being linked

syncthing installs etc/linux-desktop/syncthing-ui.desktop, which was landing in binaries. A non-empty binaries is the complete list of things to link, so that one entry suppressed discovery of syncthing itself and nothing was linked at all. Desktop-integration resources are now excluded the same way LICENSE already was.

Side files could not differ per host

PinnedExtra had no host dimension, because it was built for licences, which are the same file everywhere. pueue's daemon is a separate per-architecture release asset, so its hash differs per host and one entry cannot cover both. An [[extra]] URL containing ${arch} now pins one entry per supported host, and only the matching one is emitted. Extras without a host still apply everywhere, so existing licence pins are untouched.

Notes no longer restate other fields

Every entry carried derived prose like Official binary from <src> and [PORTABLE] (Portable Static Binary), which repeat src_url and type. Entries carrying a note drop from 537 to 8, keeping only what nothing else conveys: terms-of-service links, and [NOT PORTABLE] with its reason.

validate catches one URL serving several hosts

feroxbuster pinned the same x86_64 URL for both architectures. That is legitimate when the artifact holds every architecture and the install map selects with ${arch}, as broot does, and wrong otherwise. The check distinguishes the two, so it fires on feroxbuster and stays silent on broot.

---

sbuild validate reports 0 errors and 0 warnings across 978 pinned artifacts in 532 packages. Build is clean with no warnings.

Worth noting for sequencing: soarpkgs already has pueue's per-host extras on main. Until this lands, serde ignores the unknown host field and both pueued entries are emitted into every architecture's index, so aarch64 users would be offered the x86_64 binary.