sergio/takana

- libgcrypt + libgpg-error VARIANTES PIC (--with-pic) en incoming-kde (override, patrón zstd):
  linkean dentro de .so dinámicos. Selladas.
- kwallet: sólo librería cliente libKF6Wallet.so (lo que kio linkea). Daemons OFF:
  BUILD_KSECRETD (QCA), BUILD_KWALLETD (libsecret-1→glib), BUILD_KWALLET_QUERY. Reactivar = sellar libsecret+QCA.

Tier-3 8/8: kbookmarks sonnet ktextwidgets kiconthemes kglobalaccel kservice kxmlgui kwallet.
KF6 TOTAL: tier-1 (9) + tier-2 (10) + tier-3 (8) = 27 frameworks sellados.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

diff --git a/recipes/incoming-kde/kwallet.toml b/recipes/incoming-kde/kwallet.toml
index 531b8c35..8b64dfe8 100644
--- a/recipes/incoming-kde/kwallet.toml
+++ b/recipes/incoming-kde/kwallet.toml
@@ -4,9 +4,12 @@
 # Deps KF6 (del CMakeLists + subdirs kwalletd/kwalletbackend): kconfig, kwindowsystem, kcoreaddons, ki18n,
 # kwidgetsaddons, kdbusaddons, kcrash, knotifications. Todas selladas (tier-1/tier-2).
 # TIENE código X11 tras option(WITH_X11 ON) (KWindowSystem::isPlatformX11) → -DWITH_X11=OFF.
-# BLOCKER evitado: el daemon ksecretd (BUILD_KSECRETD=ON por defecto) exige Qca-qt6 REQUIRED 2.3.1 (QCA
-# NO sellado). Lo APAGO con -DBUILD_KSECRETD=OFF; el kwallet daemon clásico (kwalletd) usa su propio blowfish
-# y NO necesita QCA. Gpgmepp es opcional (find_package sin REQUIRED): sin él, GPG support simplemente off.
+# SÓLO LIBRERÍA CLIENTE (libKF6Wallet.so, lo que kio/apps linkean). Daemons DIFERIDOS por deps externas:
+#  - BUILD_KSECRETD=OFF: ksecretd exige Qca-qt6 REQUIRED 2.3.1 (QCA no sellado).
+#  - BUILD_KWALLETD=OFF: el daemon runtime hace pkg_check_modules(libsecret-1 REQUIRED) (bridge
+#    org.freedesktop.secrets, arrastra glib/gobject; deuda Capa 0). BUILD_KWALLET_QUERY=OFF (tool del daemon).
+# La librería cliente NO necesita libsecret/QCA. libgcrypt(PIC) queda en deps para el backend blowfish del
+# daemon cuando se reactive. Gpgmepp opcional (GPG support off). Reactivar daemon = sellar libsecret+QCA.
 name    = "kwallet"
 version = "6.27.0"
 
@@ -39,10 +42,10 @@ cmake -B build -G Ninja -Wno-dev \
   -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=/usr -DCMAKE_PREFIX_PATH=/usr \
   -DCMAKE_INTERPROCEDURAL_OPTIMIZATION=OFF \
   -DBUILD_TESTING=OFF -DBUILD_PYTHON_BINDINGS=OFF -DBUILD_DESIGNERPLUGIN=OFF \
-  -DWITH_X11=OFF -DBUILD_KSECRETD=OFF
+  -DWITH_X11=OFF -DBUILD_KSECRETD=OFF -DBUILD_KWALLETD=OFF -DBUILD_KWALLET_QUERY=OFF
 '''
 compile = "cmake --build build"
 install = "DESTDIR=/out cmake --install build"
 
 [deps]
-build = ["cmake", "samurai", "python3", "pkgconf", "qtbase", "dbus", "extra-cmake-modules", "qttools", "mesa", "libdrm", "libxkbcommon", "wayland", "gettext-tiny", "kconfig", "kwindowsystem", "kcoreaddons", "ki18n", "kwidgetsaddons", "kdbusaddons", "kcrash", "knotifications"]
+build = ["cmake", "samurai", "python3", "pkgconf", "qtbase", "dbus", "extra-cmake-modules", "qttools", "mesa", "libdrm", "libxkbcommon", "wayland", "gettext-tiny", "kconfig", "kwindowsystem", "kcoreaddons", "ki18n", "kwidgetsaddons", "kdbusaddons", "kcrash", "knotifications", "qtdeclarative", "libgcrypt"]
diff --git a/recipes/incoming-kde/libgcrypt.toml b/recipes/incoming-kde/libgcrypt.toml
new file mode 100644
index 00000000..a791d329
--- /dev/null
+++ b/recipes/incoming-kde/libgcrypt.toml
@@ -0,0 +1,24 @@
+# libgcrypt 1.12.2 — VARIANTE PIC para la campaña KDE (ADR 0011, Capa 0). Igual que la canónica
+# (recipes/libgcrypt.toml) pero con --with-pic: kwallet (kwalletbackend) linka libgcrypt DENTRO de
+# libKF6Wallet.so; sin PIC da "recompile with -fPIC". Depende de la variante PIC de libgpg-error
+# (override incoming-kde, mismo name). Patrón static↔dinámico Capa 0.
+name    = "libgcrypt"
+version = "1.12.2"
+
+[source]
+tarball = "https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-1.12.2.tar.bz2"
+sha256  = "7ce33c2492221a0436f96a8500215e9f3e3dcb5fd26a757cd415e7a843babd5e"
+
+[build]
+compiler = "gcc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+configure = './configure --build=$CBUILD --host=$CHOST --prefix=/usr --disable-shared --enable-static --with-pic --with-libgpg-error-prefix=/usr --disable-doc'
+compile   = 'make'
+install   = 'make DESTDIR=/out install'
+
+[deps]
+build = ["libgpg-error"]
diff --git a/recipes/incoming-kde/libgpg-error.toml b/recipes/incoming-kde/libgpg-error.toml
new file mode 100644
index 00000000..81ad23d3
--- /dev/null
+++ b/recipes/incoming-kde/libgpg-error.toml
@@ -0,0 +1,21 @@
+# libgpg-error 1.61 — VARIANTE PIC para la campaña KDE (ADR 0011, Capa 0). Igual que la canónica
+# (recipes/libgpg-error.toml) pero con --with-pic: kwallet linka libgpg-error DENTRO de libKF6Wallet.so
+# (dinámico) y un .a sin PIC da "recompile with -fPIC". Override incoming-kde (mismo name, gana al
+# construir desde esta cola). Mismo patrón static↔dinámico que zstd/util-linux-shared.
+name    = "libgpg-error"
+version = "1.61"
+
+[source]
+tarball = "https://gnupg.org/ftp/gcrypt/libgpg-error/libgpg-error-1.61.tar.bz2"
+sha256  = "7a85413f2bc354f4f8aa832b718af122e48965e9e0eb9012ee659c13c6385c93"
+
+[build]
+compiler = "gcc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+configure = './configure --build=$CBUILD --host=$CHOST --prefix=/usr --disable-shared --enable-static --with-pic --disable-doc --disable-tests --enable-install-gpg-error-config'
+compile   = 'make'
+install   = 'make DESTDIR=/out install'