The F-Droid repository is built with the newest F-Droid tools at every release

- Each release now installs the newest version of F-Droid's own tools that has been out for at least two weeks,
  instead of one fixed version, so the repository keeps up with F-Droid without anyone updating it by hand.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T9uhaCTSycTh1r8At679Pz

CLAUDE.md

@@ -175,11 +175,15 @@ The Android release key: alias `meweb`, certificate SHA-256
   is installed. The signing key's only copies are that secret and the owner's Nextcloud backup.
 - **The APK reaches an F-Droid repository on packages.arasaka.software from the same job** (31 Oct 2026), after the
   release is published, so the repository can lag the release page but never lead it. `.gitea/scripts/fdroid.sh`
-  installs fdroidserver into `tools/fdroid` (cached like the JDK) with uv from `setup.json` and the hash-locked
-  `packaging/fdroid/requirements.txt`, because the box has no `ensurepip` and the apt package would bring 242 others.
-  The environment is made at the cache's real path (`pwd -P`) and rebuilt whenever `fdroid --version` fails: its
-  scripts carry the absolute path they were made at, `tools/fdroid` is a symlink from a workspace that can move, and
-  0.15.1's step failed with `fdroid: not found` on exactly that.
+  installs fdroidserver with uv from `setup.json` (its download cache in `tools/fdroid`, cached like the JDK), because
+  the box has no `ensurepip` and the apt package would bring 242 others. **Nothing pins fdroidserver** (owner, 31 Oct
+  2026: no patching it from time to time): each run installs the newest fdroidserver, and the newest of everything it
+  needs, published at least 14 days before the run, so a bad upload has usually been pulled before the job sees it,
+  and prints the version it got. It installs into a fresh environment in a temporary folder with the signing key taken
+  out of its environment; nothing is kept between runs, because an environment's scripts carry the absolute path they
+  were made at, and 0.15.1's step failed with `fdroid: not found` on a kept one. A new fdroidserver that breaks
+  `fdroid update` fails this step after the release is published: the repository then lags, and the log names the
+  version to look at.
   It signs the repository with the APK's own key (`MEWEB_KEYSTORE_B64` and `MEWEB_KEYSTORE_PASS`, alias `meweb`), so
   the F-Droid fingerprint is the certificate's `5F52CFF4…FDF846` and there is no second key to lose; it refuses any
   other. It builds a new snapshot in