tmog-bin: follow tmog.org's versioned downloads and update to 1.0.0

TMOG 1.0.0 moved the site under /rtm/ and publishes each Linux tarball
under a versioned name with a .sha256 sidecar. The versionless
/downloads/TMOG-Task-Manager-Linux-x86_64.tar.gz path the hook fetched
now returns 404, so every upstream sync since 1.0.0 has failed.

Point source=() at the versioned tarball and have the hook read the
version from /rtm/version.txt and the checksum from the sidecar, which
drops the 8 MB download and the directory-name check the mutable URL
needed.

pkgbuilds/tmog-bin/.omarchy/upstream.sh

@@ -1,19 +1,12 @@
 #!/bin/bash
 # TMOG publishes no manifest for its Linux builds -- release.json describes the
-# macOS DMG only -- so the version comes from /version.txt and the checksum has
-# to be computed from the artifact itself. That is 8 MB, and only when the
-# version has actually moved, so the six-hourly check normally costs one tiny
-# request.
-#
-# The download path carries no version, which makes it worth proving that what
-# arrived is what was announced: the tarball's top-level directory is named for
-# the release, and a mismatch means the object served is not the one
-# /version.txt describes. Reporting no update leaves the checked-in package
-# alone and lets the next run try again, which is the right answer whether the
-# cause is a half-published release or a stale CDN object.
+# macOS DMG only -- so the version comes from /rtm/version.txt. Each Linux
+# artifact is published under a versioned name with a `<artifact>.sha256`
+# sidecar beside it, and that sidecar is the checksum reported here, so the
+# six-hourly check costs two tiny requests and never the tarball itself.
 set -euo pipefail
 
-BASE_URL="https://tmog.org"
+BASE_URL="https://tmog.org/rtm"
 
 current=$(grep -m1 '^pkgver=' PKGBUILD | cut -d= -f2- | tr -d "\"'")
 
@@ -28,27 +21,22 @@ if [[ $version == "$current" ]]; then
   exit 0
 fi
 
-tarball=$(mktemp)
-trap 'rm -f "$tarball"' EXIT
-
-curl -fsSL -o "$tarball" \
-  "$BASE_URL/downloads/TMOG-Task-Manager-Linux-x86_64.tar.gz?v=${version}-free"
-
-# Every entry is listed rather than just the first: `head -1` would close the
-# pipe under `tar` and take the whole hook down with SIGPIPE, and reading them
-# all also catches a tarball that unpacks more than one top-level directory.
-expected_dir="TaskManagerOG-${version}-linux-x86_64"
-served_dir=$(tar tzf "$tarball" | cut -d/ -f1 | sort -u)
-if [[ $served_dir != "$expected_dir" ]]; then
-  echo "Download holds $served_dir, but /version.txt announced $version; skipping" >&2
-  echo '{}'
-  exit 0
+# The sidecar names the file it describes; insisting on that name catches a
+# sidecar left over from another release or architecture. A failed download or
+# a file without a trailing newline leaves `read` short, which the check below
+# reports rather than letting set -e exit silently.
+artifact="TaskManagerOG-${version}-linux-x86_64.tar.gz"
+sha256="" name=""
+read -r sha256 name < <(curl -fsSL "$BASE_URL/downloads/$artifact.sha256") || true
+if [[ ! $sha256 =~ ^[0-9a-f]{64}$ || ${name#\*} != "$artifact" ]]; then
+  echo "Unusable checksum for $artifact: '$sha256 $name'" >&2
+  exit 1
 fi
 
 # "any" is bin/sync-upstream's name for the unsuffixed sha256sums array, which
-# is the one this package has: upstream publishes x86_64 alone, so there is a
-# single plain source=() rather than per-architecture arrays.
+# is the one this package has: it builds x86_64 alone, so there is a single
+# plain source=() rather than per-architecture arrays.
 jq -n \
   --arg pkgver "$version" \
-  --arg sha256 "$(sha256sum "$tarball" | cut -d' ' -f1)" \
+  --arg sha256 "$sha256" \
   '{pkgver: $pkgver, sha256sums: {any: [$sha256]}}'