Milestone 5: metered awareness, DSCP, systemd, man pages, packaging

Metered detection polls NetworkManager's Metered property over D-Bus
(feature "metered", default on; builds without D-Bus via
no-default-features). While metered the daemon closes incoming blob
connections and defers every fetch; VARDE_FORCE_METERED=true forces the
state as a kill switch and test hook. Endpoint UDP sockets get DSCP CS1
best-effort by matching bound ports to /proc/net/udp inodes (iroh hides
its fds). systemd socket activation adopts LISTEN_FDS fd 3, readiness
is a hand-rolled sd_notify READY=1 (abstract + path sockets), and
standalone binding still works unchanged. dist/ ships hardened system
and user units (DynamicUser, ProtectSystem=strict, StateDirectory,
RestrictAddressFamilies), a commented config example, scdoc man pages
validated with scdoc, and an untested PKGBUILD skeleton.

Tests: activation-socket round trip via a real fd-3 handoff, READY=1
received on a NOTIFY_SOCKET, metered daemons neither serve nor fetch.

Dependencies: zbus (optional, feature-gated D-Bus client for the
NetworkManager metered flag).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

dist/PKGBUILD

@@ -0,0 +1,49 @@
+# Maintainer: you
+#
+# UNTESTED SKELETON — best-effort Arch packaging for varde. Review before
+# building; in particular pkgver/source must point at a real release.
+
+pkgname=varde
+pkgver=0.1.0
+pkgrel=1
+pkgdesc="Content-addressed blob mirror daemon on iroh"
+arch=('x86_64' 'aarch64')
+url="https://github.com/bendiklh/varde"
+license=('MIT OR Apache-2.0')
+depends=('gcc-libs')
+optdepends=('networkmanager: metered-connection detection')
+makedepends=('cargo' 'scdoc')
+source=("$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz")
+sha256sums=('SKIP')
+
+build() {
+  cd "$pkgname-$pkgver"
+  export RUSTUP_TOOLCHAIN=stable
+  export CARGO_TARGET_DIR=target
+  cargo build --release --locked
+  scdoc < dist/varde.8.scd > varde.8
+  scdoc < dist/varde-ctl.1.scd > varde-ctl.1
+}
+
+check() {
+  cd "$pkgname-$pkgver"
+  # Integration tests spawn daemons and use the network; keep package
+  # builds to the fast unit tests.
+  cargo test --release --locked --lib -p varde-proto -p varde-daemon
+}
+
+package() {
+  cd "$pkgname-$pkgver"
+  install -Dm755 target/release/varde-daemon "$pkgdir/usr/bin/varde-daemon"
+  install -Dm755 target/release/varde-ctl "$pkgdir/usr/bin/varde-ctl"
+
+  install -Dm644 dist/varde.service "$pkgdir/usr/lib/systemd/system/varde.service"
+  install -Dm644 dist/varde.socket "$pkgdir/usr/lib/systemd/system/varde.socket"
+  install -Dm644 dist/user/varde.service "$pkgdir/usr/lib/systemd/user/varde.service"
+  install -Dm644 dist/user/varde.socket "$pkgdir/usr/lib/systemd/user/varde.socket"
+
+  install -Dm644 dist/config.toml "$pkgdir/etc/varde/config.toml"
+
+  install -Dm644 varde.8 "$pkgdir/usr/share/man/man8/varde.8"
+  install -Dm644 varde-ctl.1 "$pkgdir/usr/share/man/man1/varde-ctl.1"
+}