Build fast-ring for rc as rc, instead of copying stable's artifacts

The rc channel's Arch base can sit anywhere between stable's snapshot and
edge's, so a package built against stable's libraries is not necessarily
correct for rc. Copying stable's fast-ring artifacts into rc therefore shipped
possibly-mislinked packages to RC testers. Fast-ring packages now build
natively for all three channels, each in its own image against its own base
mirror, and the stable release's replication step is gone.

That required separating 'may be built here' from 'whose version wins'. The
release pair is now marked "pinned": its version is set per release on the rc
branch, so it builds for rc only from that branch's worktree
(OMARCHY_RC_PINS=1, set by omarchy-release rc) — master's shipped pins can
never overwrite an in-flight RC, even though check-versions now discovers rc
work like it does for edge and stable.

bin/omarchy-release

@@ -225,8 +225,12 @@ print_no_host_help() { # print_no_host_help <what> <script>
   echo "$2" >&2
 }
 
-# Creates the rc worktree on first use (a host set up before the rc branch
-# existed has none), then syncs it and kicks the service.
+# Builds the pinned release pair for the rc channel from the rc branch's own
+# worktree, creating it on first use. OMARCHY_RC_PINS marks this as the one
+# build allowed to set those packages' rc versions; OMARCHY_REPO_ROOT points
+# the worktree at the primary checkout's channel tree so all three channels
+# stay in one place. Fast-ring packages are not built here — the scheduled rc
+# release covers those from master.
 RC_TRIGGER_SCRIPT='
 set -e
 git -C /root/omarchy-pkgs fetch origin rc
@@ -236,24 +240,21 @@ if [ ! -d /root/omarchy-pkgs-rc ]; then
 fi
 git -C /root/omarchy-pkgs-rc fetch origin rc
 git -C /root/omarchy-pkgs-rc reset --hard origin/rc
-mkdir -p /root/.state
-touch /root/.state/.sync-needed-rc
-systemctl start --no-block omarchy-auto-release-rc.service
+cd /root/omarchy-pkgs-rc
+OMARCHY_RC_PINS=1 OMARCHY_REPO_ROOT=/root/omarchy-pkgs/pkgs.omarchy.org \
+  bin/repo release --mirror rc --package omarchy omarchy-settings --skip-prod-check
 '
 
-# An explicitly configured destination outranks the local-host inference: a
-# workstation that once ran a full local release carries the published-db
-# marker too, and its .repo-host must still win.
 trigger_rc_build() {
   local host
   if host=$(repo_host); then
-    print_info "Triggering rc build on $host..."
-    ssh "$host" "$RC_TRIGGER_SCRIPT"
+    print_info "Building the RC on $host (this takes a while)..."
+    ssh "$host" "source /root/.omarchy/build-credentials 2>/dev/null; $RC_TRIGGER_SCRIPT"
   elif on_repo_host; then
-    print_info "Triggering rc build locally (this is the build host)..."
+    print_info "Building the RC locally (this is the build host)..."
     bash -c "$RC_TRIGGER_SCRIPT"
   else
-    print_no_host_help "build the rc channel" "$RC_TRIGGER_SCRIPT"
+    print_no_host_help "build the release candidate" "$RC_TRIGGER_SCRIPT"
     return 1
   fi
 }