Reject fuzzy AUR overlay patches

[jeremydixon22]

AUR overlays currently use GNU patch's default fuzz allowance. That can silently ignore changed context and transplant an Omarchy customization onto an upstream recipe it was not written against.

This moves patch application into one shared helper and sets --fuzz=0 for both the live sync-aur path and the non-mutating package-worktree replay path. Exact context and ordinary line offsets remain supported; omitted or mismatched context fails closed for maintainer review.

The built-in self-test now contains two fixtures:

• an exact-context patch that must apply; and
• a patch that permissive GNU patch accepts with fuzz 1 but the shared helper must reject.

Verification:

• bash -n passes for the helper and all three changed scripts
• omarchy-pkgs self-test passes in archlinux:base-devel
• v4l2-relayd successfully replays all three existing overlays through the strict helper, with patched/ matching current/

[greptile-apps]

Greptile Summary

The PR centralizes AUR overlay application in a strict helper and disables GNU patch fuzz while preserving ordinary line-offset handling.

• Routes live AUR synchronization and package-worktree replay through apply_patch_strict.
• Adds exact-context, fuzzy-context rejection, and missing-directory self-test coverage.
• Fixes the previously reported unsafe directory-change path by explicitly exiting before invoking patch.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
helpers/patch-helpers.sh	Introduces the shared strict patch helper and safely stops before patch execution when changing into the package directory fails.
bin/sync-aur	Routes live AUR overlay application through the shared zero-fuzz helper.
bin/package-worktree	Uses the same strict helper when reconstructing the patched package workspace.
bin/omarchy-pkgs	Extends self-testing to cover exact application, fuzzy rejection, and failed directory changes.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    A[AUR package source] --> B[Sync or worktree replay]
    B --> C[apply_patch_strict]
    C --> D{Package directory accessible?}
    D -->|No| E[Exit without invoking patch]
    D -->|Yes| F[GNU patch with fuzz 0]
    F -->|Exact context| G[Apply overlay]
    F -->|Fuzzy or mismatched context| H[Reject overlay]

Loading

_{Reviews (3): Last reviewed commit: "Test missing patch target handling" | Re-trigger Greptile}

[jeremydixon22]

Addressed the review note in the latest commit: the helper now explicitly exits before invoking patch if entering the package directory fails. Rechecked syntax, exact application, failed-directory behavior, and diff cleanliness.