Fix stale ARCHITECTURE/config docs, soften source.rs's overclaim, trim the
SPEC's crate paragraph (no brittle counts), and merge the duplicate
same-origin Package test helper into test_support.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Packages can now declare source = "forgejo-release" plus a base_url and be
checked, fetched and verified against a Forgejo instance's releases API,
alongside the existing GitHub source. This is what lets pkgwatch track its
own releases from the self-hosted Forgejo.
- config: Source enum (github-release default, forgejo-release) + base_url,
validated once at load (base_url pairing, http(s) scheme, and no
github-attestation on a Forgejo source).
- source: new module mapping a package to its Endpoints.
- checker: latest_forgejo_release, one call to releases/latest; latest_release
dispatches per source.
- fetcher/verifier: take the releases API root instead of GithubEndpoints,
since GitHub and Forgejo serve the same releases/tags/<tag> shape.
- pipeline: endpoints are resolved per package.
- docs: SPEC documents the source key and why the HTTP is hand-rolled rather
than an API-client crate.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
