imsd: install the published apk instead of building it

The imsd repo's package CI is now the only producer of the imsd apk. The
image installs the exact registry package users get via 'apk upgrade'
(pinned version + sha256 of the registry files), so the two can no longer
diverge and the payload-parity rule between two packagings is gone.

pmbootstrap has no knob for a third-party repository, and after the main
'apk add' it re-adds every package in its local packages dir by file path,
which makes apk verify the package's own signature. Registry packages are
signed with per-run keys nobody keeps (phones trust the registry-signed
index), so apk-resign.py replaces the signature stream with one from this
run's abuild key; control and data streams stay byte-identical and the
identity checksum equals the registry's. Verified on the host with apk
3.0.8: originals UNTRUSTED, re-signed OK, checksums equal.

The publish step skips imsd-*: those files came from the registry.

.forgejo/workflows/build.yml

@@ -44,12 +44,14 @@ jobs:
           path: dist/*
           if-no-files-found: error
 
-      # Ship every locally built apk (kernel, modemmanager, libqmi, imsd,
+      # Ship every locally built apk (kernel, modemmanager, libqmi,
       # callaudioshim, audio files, ...) to the Forgejo Alpine registry, so
       # installed systems get updates via 'apk upgrade' instead of losing
       # the FP6 patches to the next upstream version bump. Requires the
       # PACKAGE_TOKEN repo secret (catbot account, package:write scope);
       # skips quietly until it exists. 409 = same version already published.
+      # imsd is skipped: build.sh 3b took it FROM the registry (re-signed
+      # for the chroot), so it is not ours to publish.
       - name: Publish packages to the apk registry
         env:
           PACKAGE_TOKEN: ${{ secrets.PACKAGE_TOKEN }}
@@ -62,6 +64,9 @@ jobs:
           found=0
           for f in /home/build/.local/var/pmbootstrap/packages/*/aarch64/*.apk; do
             [ -e "$f" ] || continue
+            case "$(basename "$f")" in
+              imsd-*) echo "registry-sourced, not republished: $(basename "$f")"; continue ;;
+            esac
             found=1
             code=$(curl -s -o /dev/null -w '%{http_code}' \
               --user "catbot:$PACKAGE_TOKEN" --upload-file "$f" \