feat: releases, Imager listing and box updates (MAD-809, MAD-810)

[madeofpendletonwool]

Summary

MAD-809: releases and the Raspberry Pi Imager listing (ADR 0011)

• A v* tag builds and smoke-tests the image, then the new release job publishes:
  • a GitHub Release with the .img.xz, its .sha256, the .deb, a cosign-signed (keyless) SHA256SUMS, and the CHANGELOG.md section as the notes;
  • the Imager listing at imager/os_list.json on gh-pages.
• The listing uses init_format: cloudinit-rpi, the same as Raspberry Pi's own Trixie entries, so Imager's Wi-Fi, SSH and hostname settings apply.
• The image is slimmer: docs, man pages and translations are stripped and kept out by a dpkg drop-in. The smoke test fails the build above 1 GiB.
• The README has an Install section (Imager content repository, rpi-imager --repo, pairing, verifying downloads with cosign).

MAD-810: box updates (ADR 0012)

• The box's own files moved from the stages into packaging/root/ and are built into a syncphony-box .deb (scripts/build-deb.sh). The image installs the .deb, and the stages keep only the image-specific changes (cmdline, fstab, /data links, ...).
• The release job publishes a signed apt repo on gh-pages. Only the updater uses it (-o Dir::Etc::SourceList), so pi-gen's export dist-upgrade never pulls a published package over the freshly built one.
• syncphony-update.timer runs boxd update at 04:00:
  • skips the night while the room plays (/status now reports playing) or with auto_update=off;
  • upgrades the real root through syncphony-box chroot, which now also brings /data and a temporarily writable /boot/firmware;
  • records the result in /data/syncphony-box/update.json (reported by /v1/info);
  • reboots only if something changed and the room is idle.
  • sudo syncphony-box update runs it by hand.
• apt-get update --error-on=any: an unreachable or badly signed repo shows as "update failed" instead of carrying on.
• Fix: data-persist restore merges account files instead of overwriting them. Before, users and groups an update added would have been deleted at the next boot.
• /v1/info also reports uptimeSeconds (for MAD-811).

Before the first release

• Create the apt signing key, commit packaging/apt/syncphony-box-archive-keyring.asc, and set the APT_SIGNING_KEY secret (docs/releasing.md). The release job refuses to publish without them.
• After the first release creates gh-pages: Settings → Pages → deploy from gh-pages.
• Syncphony's server expects box software ≥ 0.2.0 (madeofpendletonwool/Syncphony, MAD-811), so tag this as v0.2.0 or adjust MinBoxVersion there.

Test plan

• go test ./..., go vet, gofmt; bats suite (59, run in a Trixie container)
• .deb built and installed in debian:trixie: kiosk user and groups, cec group, all units enabled, reinstall idempotent
• End to end in a container: repo signed by scripts/apt-repo.sh, box on 1.0.0 → boxd update → 1.1.0 (plus a real Debian security update); a second run is current; a tampered InRelease is refused and recorded as failed
• scripts/imager-os-list.py sizes and hashes checked against a test .xz; actionlint, shellcheck
• CI image build and smoke test with the restructured stages (first real run is this PR)
• Overnight update on a Pi (docs/testing.md, "The overnight update")

🤖 Generated with Claude Code