Package detail: pre-built artifacts section (exact name+version DCBA match)

Iterate repositories.dcba_entries() and match each against the package's
manifest name and version with find_dcba_artifact (plain string comparison
on both, per the DCBA specification - the manifest version string is the
comparison key and the listing string never round-trips through a Version
parse). Rows carry the DCBA repository name/summary, artifact filename,
version, human size ('?' when the listing predates the size field), grouped
sha512 fingerprint, a browse link and a download href.

The prebuilt_artifacts field is only set when at least one match exists, so
the new 'Pre-built artifacts' card (between the hero and Licences) hides
entirely when no DCBA repository carries that exact name+version.

src/entrypoints/PackageDetailEntrypoint.vala

@@ -18,6 +18,21 @@ namespace UsmWeb {
         public string ref_name { get; set; default = ""; }
     }
 
+    /**
+     * One pre-built-artifact row: a DCBA repository carrying a `.dcba`
+     * built from this exact package name and version.
+     */
+    public class PrebuiltArtifactRow : Object {
+        public string repo { get; set; default = ""; }
+        public string summary { get; set; default = ""; }
+        public string file { get; set; default = ""; }
+        public string version { get; set; default = ""; }
+        public string size { get; set; default = ""; }
+        public string sha512 { get; set; default = ""; }
+        public string repo_href { get; set; default = ""; }
+        public string download_href { get; set; default = ""; }
+    }
+
     /** One licence row of the detail view. */
     public class LicenceRow : Object {
         public string name { get; set; default = ""; }
@@ -95,6 +110,38 @@ namespace UsmWeb {
             add_phase(depends, "runtime", manifest.dependencies.runtime);
             dict["depends"] = new JsonElement.from_elements(depends);
 
+            // Pre-built artifacts: DCBA repositories carrying this exact
+            // package name AND version (what `usm install` would fetch).
+            // Exact string match only — the listing's version string must
+            // equal the manifest's version string, with no Version parse
+            // round trip on the listing side.
+            var prebuilt = new JsonArray();
+            var version_key = manifest.version.to_string();
+            foreach (var dcba_entry in repositories.dcba_entries()) {
+                var artifact = dcba_entry.find_dcba_artifact(manifest.name, version_key);
+                if (artifact == null) {
+                    continue;
+                }
+                var dcba_repo = dcba_entry.repo();
+                var artifact_file = Path.get_basename(((!)artifact).path);
+                var row = new PrebuiltArtifactRow() {
+                    repo = dcba_repo.name,
+                    summary = dcba_repo.summary,
+                    file = artifact_file,
+                    version = ((!)artifact).version,
+                    size = ((!)artifact).size > 0
+                        ? PackagesState.format_size((int64)((!)artifact).size)
+                        : "?",
+                    sha512 = PackagesState.fingerprint(((!)artifact).sha512sum.to_hex()),
+                    repo_href = @"/repo/$(dcba_repo.name)",
+                    download_href = @"/repo/$(dcba_repo.name)/$artifact_file"
+                };
+                prebuilt.add(new JsonElement.from_properties(GObjectMapping.to_properties(row)));
+            }
+            if (prebuilt.length > 0) {
+                dict["prebuilt_artifacts"] = new JsonElement.from_elements(prebuilt);
+            }
+
             var state = new State() {
                 type_name = "package",
                 public_data = dict,

src/pages/package.html

@@ -31,6 +31,37 @@
             </div>
         </section>
 
+        <section class="card" stm-if="package.prebuilt_artifacts.length > 0">
+            <h2>Pre-built artifacts</h2>
+            <p class="muted">Pre-built for this exact version — installed automatically by
+                <span class="mono">usm install</span> when one of these repositories is configured.</p>
+            <div class="table-scroll">
+                <table>
+                    <thead>
+                        <tr>
+                            <th>Repository</th>
+                            <th>Artifact</th>
+                            <th>Version</th>
+                            <th class="num">Size</th>
+                            <th>SHA-512</th>
+                            <th class="num">Download</th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        <tr stm-for-prebuilt-in="package.prebuilt_artifacts">
+                            <td><a stm-attribute.href="prebuilt.repo_href" stm-text="prebuilt.repo">repository</a></td>
+                            <td class="mono" stm-text="prebuilt.file">app-1.0.0.dcba</td>
+                            <td class="mono" stm-text="prebuilt.version">1.0.0</td>
+                            <td class="num mono" stm-text="prebuilt.size">—</td>
+                            <td class="mono fingerprint" stm-text="prebuilt.sha512">—</td>
+                            <td class="num"><a class="download" title="Download .dcba"
+                               stm-attribute.href="prebuilt.download_href">&#8681;</a></td>
+                        </tr>
+                    </tbody>
+                </table>
+            </div>
+        </section>
+
         <section class="card" stm-if="package.licences.length > 0">
             <h2>Licences</h2>
             <div class="table-scroll">