Merge nucleic/gentle-river-seal-pfoj into dev

packages/build-all.sh

@@ -45,6 +45,12 @@ build_one() { # <pkgdir> <arch>
   trap 'rm -rf "$stage"' RETURN
 
   [ -d "$d/files" ] && cp -a "$d/files/." "$stage/"
+  # The runtime apt source's suite must mirror the channel it was published under
+  # (dists/<channel>; NAROS.md §3.2 "Suites mirror channels"), so @CHANNEL@ is templated
+  # here the same way @VERSION@/@ARCH@ are templated into control. Targeted rather than a
+  # blanket sed so binary payloads in files/ (e.g. the keyring .gpg) are never rewritten.
+  [ -f "$stage/etc/apt/sources.list.d/naros.sources" ] && \
+    sed -i "s/@CHANNEL@/$CHANNEL/g" "$stage/etc/apt/sources.list.d/naros.sources"
   if [ -f "$d/stage.sh" ]; then
     # shellcheck source=/dev/null
     ( set -euo pipefail; OS_DIR="$OS_DIR" . "$d/stage.sh"; stage "$stage" "$arch" ) || {