A daily job keeps the tools behind the deb and rpm repositories current

The box updates the tools that build packages.arasaka.software every morning, and
packages.yml rebuilds and re-signs the apt and rpm repositories when those tools change,
so a broken update shows up the same morning, not at the next release.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T9uhaCTSycTh1r8At679Pz

CLAUDE.md

@@ -45,7 +45,8 @@ is root-owned, so CI uses the runner user's own `~/.dotnet` (passolo's `tools/re
 
 `build.yml` runs on every push to `master`; `release.yml` on a `v*` tag (publishes the Gitea release) or by hand
 (`publish: false` builds every platform and deploys the server only); `fdroid.yml` daily at 05:23 UTC or by hand
-(the F-Droid tools, below). All three run on the Arasaka org runner `nuvola`,
+(the F-Droid tools, below); `packages.yml` daily at 05:43 UTC or by hand (the deb and rpm tools, below). All four
+run on the Arasaka org runner `nuvola`,
 user `gitea-runner`, home `/var/lib/gitea-runner`: `tools/sdk.sh` installs the SDK from `global.json` into its
 `~/.dotnet` (the system SDK in `/opt/dotnet` is older and root-owned), and the JDK, nfpm and the Android SDK are
 cached in `~/.cache/meweb`. There is deliberately no `pull_request` trigger: the runner is the production box.
@@ -174,6 +175,19 @@ The Android release key: alias `meweb`, certificate SHA-256
   `arasaka_repository_known`, or installed copies are treated as edited by hand and left alone. The package owns
   `/usr/share/arasaka-repository/meweb`, the marker that keeps the repository configured while any Arasaka package
   is installed. The signing key's only copies are that secret and the owner's Nextcloud backup.
+  **The tools that build these two repositories are the box's own Ubuntu packages** (`apt-utils` for
+  `apt-ftparchive`, `createrepo-c`, `dpkg`, `gnupg`, `rpm`), and **a daily job keeps them current** (owner, 31 Oct
+  2026: the same daily update as the F-Droid tools). The runner cannot install packages, so the update is a root
+  timer on the box, `packages-tools.timer` at 05:13 UTC (source and setup in arasaka.software,
+  `deploy/packages.arasaka.software/`). It upgrades only those packages, from Ubuntu's updates and security
+  fixes, with package lists of its own, so it never brings the rest of the box forward. There is no two-week wait,
+  as there is for fdroidserver: Ubuntu reviews and signs these updates itself. `packages.yml` follows at 05:43 UTC. It fails if
+  the morning's update failed (it reads the result with `systemctl show`, which needs no rights), then runs this
+  script with no version. When the tools' versions or this script differ from what the live repositories were built
+  from (`built-from` beside each snapshot), it rebuilds and re-signs both from the current pools with no new package,
+  swaps the links and checks the live site; otherwise it says "nothing new" and names the versions. Unlike
+  fdroidserver, these tools cannot be kept beside an older copy, so a release uses whatever is installed; an update
+  that breaks them fails the next morning's job first.
 - **The APK reaches an F-Droid repository on packages.arasaka.software from the same job** (31 Oct 2026), after the
   release is published, so the repository can lag the release page but never lead it. `.gitea/scripts/fdroid.sh`
   installs fdroidserver with uv from `setup.json` (its download cache in `tools/fdroid`, cached like the JDK), because