Add bin/repo push and stop sync from deleting production

Heavy packages build faster on a local machine, but there was no way to get
the artifacts to the server: bin/upload-prebuilt publishes to the rclone
remote from whatever tree it runs in, so the local -> host hop was manual.

bin/repo push rsyncs build-output artifacts to the host, verifies checksums,
and runs upload-prebuilt over ssh. Signing stays on the host, which is the
only machine with the key and the only one holding a complete repository.

Publishing from a local checkout was worse than merely unsupported. sync ran
rclone sync --delete-after against a tree that pkgs.omarchy.org/ gitignores,
so on any machine that had not run a full release it would have deleted the
production repository -- guarded only by a y/N prompt that --skip-prod-check
turns off. Package uploads are now additive, deletion moves behind --prune,
and sync refuses to publish a database built from a tree holding fewer
packages than the remote already lists.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -75,6 +75,20 @@ bin/repo update                         # Update database
 bin/repo sync                           # Sync to remote
 ```
 
+### Building Heavy Packages Locally
+
+Large packages build faster on a local machine than on the server. Build them
+here, then hand the artifacts to the build host, which signs and publishes them:
+
+```bash
+bin/repo build --package nvidia-580xx-utils    # Build on the fast machine
+bin/repo push --package nvidia-580xx-utils     # Upload + publish on the host
+```
+
+`push` uploads to the host's `build-output/`, verifies checksums, and runs
+`bin/upload-prebuilt` there. Do not publish from a local checkout instead: only
+the build host holds the complete repository and the signing key.
+
 ## Commands
 
 ### Global Flags
@@ -141,10 +155,50 @@ bin/repo sync                           # Sync current arch/mirror
 bin/repo sync --mirror stable           # Sync stable
 bin/repo sync --arch aarch64            # Sync ARM64
 bin/repo sync --skip-prod-check         # No confirmation
+bin/repo sync --prune                   # Also delete remote packages missing locally
 ```
 
 Syncs package repositories to the remote server using rclone based on the configured mirror and architecture.
 
+**Uploads are additive.** A local tree is not authoritative about what belongs on
+the remote — `pkgs.omarchy.org/` is gitignored, and packages built on another
+machine exist only there — so sync never deletes by default. Removing packages
+from the remote requires `--prune`, which only makes sense from a complete tree.
+
+For the same reason sync refuses to publish a repository database built from a
+tree holding fewer packages than the remote database already lists. The database
+is what pacman resolves against, so a partial one hides every package it does not
+know about even though the files are still on the mirror. Use `bin/repo push` to
+publish packages built on another machine.
+
+### Push to the Build Host
+
+```bash
+bin/repo push                                  # Push everything in build-output
+bin/repo push --package nvidia-580xx-utils     # Push one package
+bin/repo push --mirror stable --arch aarch64   # Pick mirror and architecture
+bin/repo push --host root@example.com          # Override the build host
+bin/repo push --dry-run                        # Show the plan, transfer nothing
+```
+
+Uploads packages from `build-output/` to the build host and publishes them there
+with `bin/upload-prebuilt` (sign → promote → update → sync). Use it when a package
+is quicker to build on a local machine than on the server.
+
+Publishing happens on the host rather than locally for two reasons: the GPG
+signing key lives there and nowhere else, and only the host holds the complete
+repository that a correct database and sync require. Local machines therefore
+need no secrets.
+
+The host comes from `--host`, `$OMARCHY_BUILD_HOST`, or `.build-host`, in that
+order. Note that `.build-host` also arms the automatic build trigger in
+`bin/omarchy-pkgs release`; pass `--host` or set `OMARCHY_BUILD_HOST` to keep the
+two separate.
+
+Split packages are selected by their own names, not their pkgbase — pushing
+`nvidia-580xx-utils` does not carry `nvidia-580xx-dkms` along. Omit `--package` to
+push everything built.
+
 ### Sync AUR PKGBUILDs
 
 ```bash
@@ -161,6 +215,7 @@ bin/repo migrate --arch x86_64       # Promote tested edge artifacts -> stable,
 bin/repo migrate --package <name>    # Promote a single package -> stable
 bin/repo migrate --dry-run           # Preview migration and cleanup
 bin/repo list                        # List package metadata
+bin/repo push                        # Upload local builds to the host and publish
 bin/add-package <package>            # Add an AUR/local package with metadata
 bin/package-worktree <package>       # Create upstream/patched/current scratch workspace
 bin/repo remove <package>            # Remove package