Record the boot recipes as manual holds and state pacman's repository order

A bare uboot-asahi comes from whichever repository is listed first, so the
comment now says when this build wins and when asahi-alarm's does.

docs/upstream-sources.md

@@ -170,6 +170,8 @@ These packages were already excluded from automatic AUR updates. The migration p
 
 `linux-firmware-cirrus` is a deliberate hold: a self-retiring shim that ships Arch's linux-firmware-cirrus 20260910-2 payload to stable while stable's Arch snapshot is on 20260810-2 (Dell XPS 13 DX13260 / 1028:0e54 speaker firmware). It is versioned 20260810-3 so the genuine Arch package supersedes it as soon as the snapshot advances; bumping it to the Arch version would defeat that. Delete the recipe once stable's snapshot carries linux-firmware >= 20260910.
 
+`m1n1-aurora` and `uboot-asahi` are deliberate holds: Apple Silicon boot code, pinned by hand like `linux-aurora`, and bumped only after a cold boot on the qualification Macs. `m1n1-aurora` pins an aurora-silicon/m1n1 commit plus a local patch. `uboot-asahi` follows asahi-alarm's recipe and patch set (asahi-alarm/PKGBUILDs), which a tag watch on AsahiLinux/u-boot cannot carry.
+
 ## Package-specific boundaries
 
 - NVIDIA watches remain on the 580 driver branch.