The release job feeds packages.arasaka.software itself; YoloCICD is gone

.gitea/scripts/packages.sh signs the rpm with the org secret PACKAGES_SIGNING_KEY,
publishes the deb and rpm into a new snapshot of the repository, signs its metadata and
rewrites SHA256SUMS.txt, on the nuvola runner. Tested against a copy of the live
repository with Debian 13 apt and Fedora 44 dnf.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KizzWs2WQPWN2qgE7G6r8B

CLAUDE.md

@@ -143,13 +143,20 @@ The Android release key: alias `meweb`, certificate SHA-256
   the network and the block without the publisher's server. A change to any knowledge file's format bumps
   `KnowledgeFeeder.Format` and the `"format":N` that `wait-knowledge.sh` waits for: the feeder rebuilds only when a
   source changes or the format differs, and a release must not embed the previous build.
-- **The deb and rpm reach packages.arasaka.software through YoloCICD.** `release.yml` runs `yolo repo submit
-  --replace-signed` on tags (org secret `YOLO_TOKEN`, `yolo` installed on nuvola by YoloCICD): the files go to the
-  bot's private inbox, YoloCICD's `publish.yml` checks this run against the tag, signs the rpm, gates on an upgrade
-  check in containers and publishes; the signed rpm replaces the local one, then `yolo sums` rewrites SHA256SUMS.
-  `packaging/arasaka-repository.sh` is generated (`yolo repo kit --out`, never edited by hand) and is written into
-  both maintainer scripts by `tools/release.cs`; the package owns `/usr/share/arasaka-repository/meweb`, the marker
-  that keeps the repository configured while any Arasaka package is installed.
+- **The deb and rpm reach packages.arasaka.software from this repository's own release job.** On tags,
+  `.gitea/scripts/packages.sh` runs on the `nuvola` runner (host mode, user `gitea-runner`, which owns
+  `/var/www/packages.arasaka.software`). It imports the org secret `PACKAGES_SIGNING_KEY` into a throwaway
+  `GNUPGHOME`, refuses any key but `F92C166E…3FB2`, signs the rpm in place, hard-links the current pool into a new
+  `.snap/` folder, adds this version, keeps the newest five, rebuilds and signs the apt (`InRelease`, `Release.gpg`)
+  and rpm (`repomd.xml.asc`) metadata, carries over the files the previous `repomd.xml` named so a client mid-refresh
+  still finds them, swaps the `apt` and `rpm` links, rewrites `SHA256SUMS.txt` for the signed rpm, and checks the live
+  site. Never copy a package over a pool file: the pools are hard links into older snapshots, so it is `rm` then `cp`.
+  `PACKAGES_ROOT` and `PACKAGES_KEEP` exist for a test against a copy. YoloCICD, which used to do this, was erased on
+  23 Oct 2026. `packaging/arasaka-repository.sh` is written into both maintainer scripts by `tools/release.cs`; it is
+  now maintained here by hand, and any change to a file it writes needs the old content's SHA-256 kept in
+  `arasaka_repository_known`, or installed copies are treated as edited by hand and left alone. The package owns
+  `/usr/share/arasaka-repository/meweb`, the marker that keeps the repository configured while any Arasaka package
+  is installed. The signing key's only copies are that secret and the owner's Nextcloud backup.
 - **The server cannot ping**: `NoNewPrivileges` drops `ping`'s file capability and `ping_group_range` is closed, so
   the trace back to a caller uses `tracepath` (UDP, unprivileged) and keeps only public hops outside `Probe:Refuse`,
   so the box's own network never reaches an app.