"me-web?" 0.13.0: updates on Linux arrive through your package manager

- Installing the deb or the rpm now also adds the Arasaka package repository, packages.arasaka.software, so later
  versions of “me-web?” arrive through apt, dnf, zypper or your software centre, like any other program.
- The rpm is now signed. On openSUSE, import the key once with
  sudo rpm --import https://packages.arasaka.software/arasaka.asc
- Removing the package keeps the repository until no Arasaka package is left (purge on Debian and Ubuntu); a
  repository file you edited by hand is never touched.
- The download and privacy pages say so; the repository server keeps no access log.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

CLAUDE.md

@@ -143,6 +143,13 @@ The Android release key: alias `meweb`, certificate SHA-256
   the network and the block without the publisher's server. A change to any knowledge file's format bumps
   `KnowledgeFeeder.Format` and the `"format":N` that `wait-knowledge.sh` waits for: the feeder rebuilds only when a
   source changes or the format differs, and a release must not embed the previous build.
+- **The deb and rpm reach packages.arasaka.software through YoloCICD.** `release.yml` runs `yolo repo submit
+  --replace-signed` on tags (org secret `YOLO_TOKEN`, `yolo` installed on nuvola by YoloCICD): the files go to the
+  bot's private inbox, YoloCICD's `publish.yml` checks this run against the tag, signs the rpm, gates on an upgrade
+  check in containers and publishes; the signed rpm replaces the local one, then `yolo sums` rewrites SHA256SUMS.
+  `packaging/arasaka-repository.sh` is generated (`yolo repo kit --out`, never edited by hand) and is written into
+  both maintainer scripts by `tools/release.cs`; the package owns `/usr/share/arasaka-repository/meweb`, the marker
+  that keeps the repository configured while any Arasaka package is installed.
 - **The server cannot ping**: `NoNewPrivileges` drops `ping`'s file capability and `ping_group_range` is closed, so
   the trace back to a caller uses `tracepath` (UDP, unprivileged) and keeps only public hops outside `Probe:Refuse`,
   so the box's own network never reaches an app.