fix(build): drop sanoid from the baked AUR setHEADmain

sanoid depends on perl-config-inifiles, which is AUR-only. makepkg -s can't resolve it from the official repos, so the build aborts before it produces an ISO. The 2026-06-09 dependency gate checked AUR-RPC existence rather than the official sync dbs, so it wrongly classified perl-config-inifiles as official. A full build caught it.

sanoid joins paru and mkinitcpio-firmware as AUR-of-AUR packages deferred to the vNext dependency-resolution work. The v1 baked set is now eight packages. Updated the tests and README to match.

3 files changed, 17 insertions, 13 deletions

diff --git a/README.org b/README.org
index 7eaca4f..32696ae 100644
--- a/README.org
+++ b/README.org
@@ -69,9 +69,9 @@ back to the upstream URLs.
 them into the ISO as a local pacman repo at ~/usr/share/aur-packages~.
 They work in the live environment (~pacman -Sl aur~) and install onto
 the target offline, so the installer never needs the AUR or a build
-toolchain on the target. The v1 set (audited 2026-06-09):
+toolchain on the target. The v1 set (re-audited 2026-06-16):
 ~downgrade~, ~yay~, ~informant~, ~zrepl~, ~pacman-cleanup-hook~,
-~sanoid~, ~zfs-auto-snapshot~, ~topgrade~, ~ventoy-bin~.
+~zfs-auto-snapshot~, ~topgrade~, ~ventoy-bin~.
 
 Building these needs ~base-devel~ and ~git~ on the build host, and the
 build must run under ~sudo~ so it can drop to your user for ~makepkg~
diff --git a/build-aur.sh b/build-aur.sh
index 9b83a33..3bec75c 100644
--- a/build-aur.sh
+++ b/build-aur.sh
@@ -18,12 +18,14 @@
 #############################
 
 # The v1 genuine-AUR build set: packages with no exact official-repo match
-# whose runtime + make deps all resolve from official / archzfs / the baked
-# local repo (the v1 dependency gate). paru (second helper) and
-# mkinitcpio-firmware (pulls AUR firmware deps) are deferred to vNext.
-# Audited 2026-06-09. This list is the one place the set is named; build.sh
-# reads it for the package-list append, and the manifest records what
-# actually shipped.
+# whose runtime + make deps all resolve from the official repos / archzfs
+# (the v1 dependency gate). paru (second helper), mkinitcpio-firmware, and
+# sanoid are deferred to vNext: each pulls an AUR-of-AUR dependency that
+# makepkg -s can't resolve from the official repos (sanoid needs
+# perl-config-inifiles, which is AUR-only). Re-audited 2026-06-16 against the
+# official sync dbs after a real build caught sanoid's missing dep. This list
+# is the one place the set is named; build.sh reads it for the package-list
+# append, and the manifest records what actually shipped.
 aur_v1_packages() {
     printf '%s\n' \
         downgrade \
@@ -31,7 +33,6 @@ aur_v1_packages() {
         informant \
         zrepl \
         pacman-cleanup-hook \
-        sanoid \
         zfs-auto-snapshot \
         topgrade \
         ventoy-bin
diff --git a/tests/unit/test_build_aur.bats b/tests/unit/test_build_aur.bats
index 4da66fe..360f2b7 100644
--- a/tests/unit/test_build_aur.bats
+++ b/tests/unit/test_build_aur.bats
@@ -15,12 +15,12 @@ setup() {
 # aur_v1_packages — single source of truth for the v1 build set
 #############################
 
-@test "aur_v1_packages lists the nine audited v1 packages" {
+@test "aur_v1_packages lists the eight audited v1 packages" {
     run aur_v1_packages
     [ "$status" -eq 0 ]
-    [ "$(echo "$output" | wc -l)" -eq 9 ]
+    [ "$(echo "$output" | wc -l)" -eq 8 ]
     for pkg in downgrade yay informant zrepl pacman-cleanup-hook \
-               sanoid zfs-auto-snapshot topgrade ventoy-bin; do
+               zfs-auto-snapshot topgrade ventoy-bin; do
         [[ "$output" == *"$pkg"* ]]
     done
 }
@@ -28,9 +28,12 @@ setup() {
 @test "aur_v1_packages excludes the vNext-deferred packages" {
     run aur_v1_packages
     [ "$status" -eq 0 ]
-    # paru (second helper) and mkinitcpio-firmware (AUR-of-AUR deps) are vNext
+    # paru (second helper), mkinitcpio-firmware, and sanoid all pull AUR-of-AUR
+    # deps (sanoid needs perl-config-inifiles, AUR-only) — deferred to the
+    # vNext helper-driven dependency-resolution work.
     [[ "$output" != *"paru"* ]]
     [[ "$output" != *"mkinitcpio-firmware"* ]]
+    [[ "$output" != *"sanoid"* ]]
 }
 
 @test "aur_v1_packages emits one package per line" {