fix: verify against upstream manifest

.gitignore

@@ -4,3 +4,4 @@
 /claude-code-*.tgz
 /claude-code-*.pkg.tar*
 /claude-code-*.src.tar*
+/manifest.json

PKGBUILD

@@ -10,11 +10,26 @@ options=('!strip')
 provides=('claude')
 conflicts=('claude')
 
-source=("claude::https://downloads.claude.ai/claude-code-releases/${pkgver}/linux-x64/claude"
+source=("manifest.json::https://downloads.claude.ai/claude-code-releases/${pkgver}/manifest.json"
+        "claude::https://downloads.claude.ai/claude-code-releases/${pkgver}/linux-x64/claude"
         "claude.sh")
-sha256sums=('c9f04d929f18bd9a101f3897f27de4e1e0f15ebe8400d4aaf02983d73dd66b1d'
+sha256sums=('SKIP'
+            'SKIP'
             'd4f14ff492a181c59f42b32cf97d8682801d77ae7be0a96f5730c22755dd16c0')
 
+check() {
+    local manifest
+    manifest=$(< manifest.json)
+    [[ $manifest =~ \"linux-x64\"[^}]*\"checksum\":[[:space:]]*\"([a-f0-9]{64})\" ]]
+    local expected="${BASH_REMATCH[1]}"
+    local actual
+    actual=$(sha256sum claude | cut -d' ' -f1)
+    if [[ "$actual" != "$expected" ]]; then
+        error "Binary checksum mismatch: got $actual, manifest has $expected"
+        return 1
+    fi
+}
+
 package() {
     install -Dm755 claude "${pkgdir}/usr/lib/claude-code/claude"
     install -Dm755 claude.sh "${pkgdir}/usr/bin/claude"