Track anthropics/claude-code releases

Same-origin-sha256 (tier 4) against SHASUMS256.txt — no GitHub
attestations upstream. A PGP signature over the checksum file also
ships (SHASUMS256.txt.sig) but pkgwatch has no minisign/GPG verifier
yet; revisit once tier 1 lands. Tracks the glibc x86_64 Linux build.

Confirmed working end to end: check -> fetch -> verify against the
real repo (v2.1.276 at time of writing).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

packages.d/claude-code.toml

@@ -0,0 +1,26 @@
+# Verified 2026-09-18 against the real repo: anthropics/claude-code does not
+# publish GitHub build-provenance attestations (the attestations API 404s
+# for a fresh release asset) — tier 4, same-origin checksum only, not tier
+# 2. Motivation: track the fast-moving Claude Code CLI directly from
+# upstream releases rather than npm/curl|sh.
+#
+# Releases ship a combined `SHASUMS256.txt` (one line per platform asset,
+# same `<hash>  <filename>` shape as scaleway-cli's `SHA256SUMS`) plus a
+# detached `SHASUMS256.txt.sig` PGP signature over that checksum file —
+# stronger than plain same-origin-sha256 (closer to tier 1, pinned-key
+# signature) but pkgwatch doesn't implement PGP/minisign verification yet
+# (see SPEC.md > Status: tier-1 `minisign` method not yet implemented).
+# Revisit and upgrade this package's tier once that lands.
+#
+# Release tags are static per-platform filenames (no version embedded), so
+# no `{version}` placeholder is needed, same as uv's config. Tracking the
+# glibc x86_64 Linux build (`claude-linux-x64.tar.gz`), not the musl
+# variant, to match this machine.
+
+[package.claude-code]
+repo = "anthropics/claude-code"
+asset_pattern = "claude-linux-x64.tar.gz"
+
+[package.claude-code.verification]
+method = "same-origin-sha256"
+checksum_asset_pattern = "SHASUMS256.txt"