Move cua-driver-bin off the fast ring and keep its bumps manual (#692)

Build it in edge and promote through rc to stable like other packages,
matching cua-hyprland-plugin, which left the fast ring in #432.

#693 held upstream sync while 0.28.3+ breaks screenshots. Make that the
standing policy: Omarchy bumps the driver by hand, so the PKGBUILD no
longer says to re-enable sync after the fix, and docs/upstream-sources.md
records the hold. The hook and min_release_age stay, so lifting the hold
is a one-line revert.

Publish as 0.28.2-3 so the PR builds; the payload is unchanged.

docs/upstream-sources.md

@@ -229,6 +229,8 @@ These packages were already excluded from automatic AUR updates. The migration p
 
 `m1n1-aurora` and `uboot-asahi` are deliberate holds: Apple Silicon boot code, pinned by hand like `linux-aurora`, and bumped only after a cold boot on the qualification Macs. `m1n1-aurora` pins an aurora-silicon/m1n1 commit plus a local patch. `uboot-asahi` follows asahi-alarm's recipe and patch set (asahi-alarm/PKGBUILDs), which a tag watch on AsahiLinux/u-boot cannot carry.
 
+`cua-driver-bin` is a deliberate hold: Omarchy bumps it by hand, so a Cua release ships only when a maintainer has verified it. It keeps its `.omarchy/upstream.sh` hook and `min_release_age`, so lifting the hold means removing `"sync": false`. `cua-hyprland-plugin` declares no upstream source, so no automation updates it either.
+
 ## Package-specific boundaries
 
 - NVIDIA watches remain on the 580 driver branch.

pkgbuilds/cua-driver-bin/.omarchy/package.json

@@ -1,6 +1,5 @@
 {
   "source": "local",
   "sync": false,
-  "release_ring": "fast",
   "min_release_age": "24h"
 }

pkgbuilds/cua-driver-bin/PKGBUILD

@@ -5,8 +5,9 @@
 # compiler, and the SDK artifacts together in one directory and exposes the
 # CLI through a symlink -- the binary resolves its helpers as siblings of
 # /proc/self/exe -- so the whole tree lands under /usr/lib/cua-driver with a
-# /usr/bin symlink. .omarchy/upstream.sh rewrites the version and checksums
-# below from the release feed.
+# /usr/bin symlink. Upstream updates are held ("sync": false): Omarchy bumps
+# the version and checksums below by hand, from the release's checksums.txt.
+# .omarchy/upstream.sh still selects releases for when the hold lifts.
 #
 # The binary carries its own updater: `cua-driver update --apply` pipes the
 # vendor installer into bash, which would install a second copy under
@@ -18,10 +19,10 @@
 # binary to point at pm.sh, a stand-in that declines and names pacman instead.
 
 pkgname=cua-driver-bin
-# Hold at 0.28.2 while upstream fixes screenshot regressions in 0.28.3+.
-# Re-enable upstream sync in .omarchy/package.json after verifying the fix.
+# Held at 0.28.2: 0.28.3 and newer break screenshots. Bump by hand once a
+# fixed release is verified.
 pkgver=0.28.2
-pkgrel=2
+pkgrel=3
 pkgdesc="Computer-use driver for native GUI apps: accessibility-tree snapshots and input injection"
 arch=('x86_64' 'aarch64')
 url="https://github.com/trycua/cua"