verify-tracked-sources: brush is a fork, match provenance case-insensitively

brush records `# Upstream: https://github.com/reubeno/brush`, but the check
matched `upstream:` case-sensitively AND required the URL to end in .tar/.git,
so it missed on both counts and filed a genuine fork as first-party.

Now matches an explicit upstream/snapshot/origin label followed by a URL, any
case. Deliberately NOT any bare URL in a comment: a stray bug-tracker link must
never read as provenance, since that error direction (first-party treated as
vendored) is the one that loses irreplaceable work.

Remaining inaccuracy is missing DATA, not detection. libepoxy, libpciaccess,
libudev, libxcvt and libdisplay-info are upstream projects whose recipes carry
only `path = "source"` with no origin recorded anywhere, so nothing can tell
them apart from our own code. They classify first-party, which is merely
stricter. The real fix is to record their upstream in the recipe.

local/scripts/verify-tracked-sources.sh

@@ -244,8 +244,20 @@ redbear_is_firstparty() {
         dir="$(dirname "$dir")"
     done
     [ -f "$dir/recipe.toml" ] || return 1
+    # Fetchable origin keys.
     grep -qE '^[[:space:]]*(tar|git)[[:space:]]*=' "$dir/recipe.toml" && return 1
-    grep -qE 'upstream:[[:space:]]*http|https?://[^[:space:]]+\.(tar|git)' "$dir/recipe.toml" && return 1
+    # Provenance recorded in prose by a vendored fork. Case-INSENSITIVE and not
+    # restricted to .tar/.git URLs: brush writes
+    #     # Upstream: https://github.com/reubeno/brush
+    # which a case-sensitive `upstream:` + \.(tar|git) match missed on both
+    # counts, misfiling a genuine fork as first-party.
+    #
+    # Matched narrowly -- an explicit `upstream:`/`snapshot:` label followed by a
+    # URL -- NOT any bare URL in a comment. A stray bug-tracker link must never
+    # be read as provenance, because that error direction (first-party treated
+    # as vendored) is the one that loses irreplaceable work.
+    grep -qiE '^[[:space:]]*#?[[:space:]]*(upstream|snapshot|origin)[[:space:]]*:[[:space:]]*(https?://|[A-Za-z0-9_.-]+/)' \
+        "$dir/recipe.toml" && return 1
     return 0
 }