build.yml: route 4 fourier-debian jobs to debian-aarch64 (bohr) (#47)

Closes task #134 work.

PR #44 showed the cross-distro ABI hazard for `libva-v4l2-request-fourier-debian`: building on Arch (libva 2.23) produced `__vaDriverInit_1_23`, which trixies libva 2.22 runtime cant bind. Same hazard applies to other fourier-debian jobs that link against debian-native libs.

**Moved from runs-on: arch-aarch64 → debian-aarch64:**
- ffmpeg-v4l2-request-debian
- mpv-fourier-debian
- daedalus-v4l2-debian
- daedalus-v4l2-dkms-debian

**Left alone (arch=all, no native compile against debian libs):**
- lmcp-debian
- claude-his-debian

Depends on PR #46 (label vs name fix) being merged so `debian-aarch64` actually routes to bohr.

Reviewed-on: marfrit/marfrit-packages#47

.gitea/scripts/check-already-published.sh

@@ -193,13 +193,33 @@ debian)
   esac
 
   pkg_name=$(basename "$RECIPE_DIR")
-  first_letter="${pkg_name:0:1}"
 
-  url="${REPO_BASE}/debian/pool/main/${first_letter}/${pkg_name}/${pkg_name}_${ver_full}_${file_arch}.deb"
-  code=$(http_head "$url")
-  if [ "$code" = "200" ]; then
+  # Compare against the canonical Packages index (what apt actually
+  # consults).  reprepro refuses lower-version uploads, so checking
+  # only an exact source-pkgrel URL produces an endless-rebuild trap
+  # whenever source PKGREL has rolled back below pool head.  We skip
+  # if pools published version >= source version-tuple.
+  source_full="${ver_full}"
+  if [ -n "${PKGVER#*:}" ] && [ "${PKGVER}" != "${PKGVER#*:}" ]; then
+    # PKGVER had an epoch — keep it for dpkg --compare-versions.
+    source_full="${PKGVER}-${PKGREL}"
+  fi
+
+  # Determine suite: most recipes publish to both bookworm and trixie;
+  # checking trixie is sufficient (changelogs share Distribution).
+  suite="trixie"
+  pkg_arch_label="$file_arch"
+  [ "$file_arch" = "all" ] && pkg_arch_label="all"
+  packages_url="${REPO_BASE}/debian/dists/${suite}/main/binary-arm64/Packages"
+  [ "$file_arch" = "amd64" ] && packages_url="${REPO_BASE}/debian/dists/${suite}/main/binary-amd64/Packages"
+
+  pool_ver=$(set +o pipefail; curl -sS --max-time "$HEAD_TIMEOUT" "$packages_url" 2>/dev/null     | awk -v p="$pkg_name" '$1=="Package:" && $2==p {found=1; next} found && $1=="Version:" {print $2; exit}')
+
+  if [ -n "$pool_ver" ] && command -v dpkg >/dev/null &&        dpkg --compare-versions "$pool_ver" ge "$source_full"; then
+    echo "pool has $pool_ver >= source $source_full" >&2
     emit 1
   fi
+  echo "pool has $pool_ver, source wants $source_full — build" >&2
   emit 0
   ;;
 

.gitea/workflows/build.yml

@@ -906,7 +906,7 @@ jobs:
   # -------------------------------------------------------------------------
   ffmpeg-v4l2-request-debian:
     needs: ffmpeg-v4l2-request-aarch64
-    runs-on: arch-aarch64
+    runs-on: debian-aarch64
     continue-on-error: true
     steps:
       - uses: actions/checkout@v4
@@ -1045,7 +1045,7 @@ jobs:
   # -------------------------------------------------------------------------
   mpv-fourier-debian:
     needs: mpv-fourier-aarch64
-    runs-on: arch-aarch64
+    runs-on: debian-aarch64
     continue-on-error: true
     steps:
       - uses: actions/checkout@v4
@@ -1131,7 +1131,7 @@ jobs:
   # -------------------------------------------------------------------------
   daedalus-v4l2-debian:
     needs: claude-his-debian
-    runs-on: arch-aarch64
+    runs-on: debian-aarch64
     continue-on-error: true
     steps:
       - uses: actions/checkout@v4
@@ -1220,7 +1220,7 @@ jobs:
   # -------------------------------------------------------------------------
   daedalus-v4l2-dkms-debian:
     needs: daedalus-v4l2-debian
-    runs-on: arch-aarch64
+    runs-on: debian-aarch64
     continue-on-error: true
     steps:
       - uses: actions/checkout@v4

debian/claude-his-agent/build-deb.sh

@@ -16,7 +16,7 @@ work=$(mktemp -d)
 trap "rm -rf $work" EXIT
 
 cd "$work"
-curl -sSLfo his.tar.gz \
+curl --connect-timeout 10 --max-time 600 --retry 3 --retry-delay 5 -sSLfo his.tar.gz \
     "https://git.reauktion.de/marfrit/claude-his-agent/archive/v${PKGVER}.tar.gz"
 echo "$HIS_TARBALL_SHA256  his.tar.gz" | sha256sum -c
 tar xzf his.tar.gz

debian/daedalus-v4l2-dkms/build-deb.sh

@@ -28,7 +28,7 @@ work=$(mktemp -d)
 trap "rm -rf $work" EXIT
 
 cd "$work"
-curl -sSLfo daedalus-v4l2.tar.gz \
+curl --connect-timeout 10 --max-time 600 --retry 3 --retry-delay 5 -sSLfo daedalus-v4l2.tar.gz \
     "https://git.reauktion.de/reauktion/daedalus-v4l2/archive/${UPSTREAM_COMMIT}.tar.gz"
 tar xzf daedalus-v4l2.tar.gz
 SRCDIR=daedalus-v4l2

debian/daedalus-v4l2/build-deb.sh

@@ -28,7 +28,7 @@ work=$(mktemp -d)
 trap "rm -rf $work" EXIT
 
 cd "$work"
-curl -sSLfo daedalus-v4l2.tar.gz \
+curl --connect-timeout 10 --max-time 600 --retry 3 --retry-delay 5 -sSLfo daedalus-v4l2.tar.gz \
     "https://git.reauktion.de/reauktion/daedalus-v4l2/archive/${UPSTREAM_COMMIT}.tar.gz"
 tar xzf daedalus-v4l2.tar.gz
 SRCDIR=daedalus-v4l2

debian/libva-v4l2-request-fourier/build-deb.sh

@@ -27,7 +27,7 @@ work=$(mktemp -d)
 trap "rm -rf $work" EXIT
 
 cd "$work"
-curl -sSLfo libva-fourier.tar.gz \
+curl --connect-timeout 10 --max-time 600 --retry 3 --retry-delay 5 -sSLfo libva-fourier.tar.gz \
     "https://git.reauktion.de/marfrit/libva-v4l2-request-fourier/archive/${UPSTREAM_COMMIT}.tar.gz"
 tar xzf libva-fourier.tar.gz
 SRCDIR=$(echo libva-v4l2-request-fourier)

debian/lmcp/build-deb.sh

@@ -23,7 +23,7 @@ work=$(mktemp -d)
 trap "rm -rf $work" EXIT
 
 cd "$work"
-curl -sSLfo lmcp.tar.gz "https://git.reauktion.de/marfrit/lmcp/archive/${UPSTREAM_TAG}.tar.gz"
+curl --connect-timeout 10 --max-time 600 --retry 3 --retry-delay 5 -sSLfo lmcp.tar.gz "https://git.reauktion.de/marfrit/lmcp/archive/${UPSTREAM_TAG}.tar.gz"
 echo "$LMCP_TARBALL_SHA256  lmcp.tar.gz" | sha256sum -c
 tar xzf lmcp.tar.gz
 

debian/mpv-fourier/build-deb.sh

@@ -33,7 +33,7 @@ work=$(mktemp -d)
 trap "rm -rf $work" EXIT
 
 cd "$work"
-curl -sSLfo mpv.tar.gz \
+curl --connect-timeout 10 --max-time 600 --retry 3 --retry-delay 5 -sSLfo mpv.tar.gz \
     "https://github.com/mpv-player/mpv/archive/v${MPV_VERSION}/mpv-${MPV_VERSION}.tar.gz"
 echo "$MPV_TARBALL_SHA256  mpv.tar.gz" | sha256sum -c
 tar xzf mpv.tar.gz