Run 49 died in section 3b: pmbootstrap's abuild-keygen runs inside the
chroot as its own user (uid 12345), so the key in config_abuild/ is 0600 to
that uid and the build user cannot read it; openssl dgst -sign exited 1 and
apk-resign.py swallowed its stderr. Take a private copy via sudo for the
duration of the re-sign, and make the script name an unreadable key and let
openssl's stderr through instead of hiding it.
The imsd repo's package CI is now the only producer of the imsd apk. The
image installs the exact registry package users get via 'apk upgrade'
(pinned version + sha256 of the registry files), so the two can no longer
diverge and the payload-parity rule between two packagings is gone.
pmbootstrap has no knob for a third-party repository, and after the main
'apk add' it re-adds every package in its local packages dir by file path,
which makes apk verify the package's own signature. Registry packages are
signed with per-run keys nobody keeps (phones trust the registry-signed
index), so apk-resign.py replaces the signature stream with one from this
run's abuild key; control and data streams stay byte-identical and the
identity checksum equals the registry's. Verified on the host with apk
3.0.8: originals UNTRUSTED, re-signed OK, checksums equal.
The publish step skips imsd-*: those files came from the registry.
