ci: publish into edge additively

edge is a shared archive but ci.yml deleted and recreated it each push, erasing
other producers. publish-edge.sh merges into the live db under a flock and
removes only its own superseded builds. Verifies the merge kept every foreign
entry, and reads the db back before trusting it.

.gitea/workflows/ci.yml

@@ -324,51 +324,31 @@ jobs:
             gpg --batch --yes --local-user "$ARCHIVE_KEY" \
               --detach-sign "$ARCH_REPO/$(basename "$UPKG")"
 
-            # Pacman databases are architecture-specific: one database cannot
-            # retain two same-named, same-version packages for different
-            # architectures. Keep each database and its assets distinct.
-            DB="souveraine-${ARCH}"
-            repo-add --include-sigs --sign --key "$ARCHIVE_KEY" \
-              "$ARCH_REPO/$DB.db.tar.zst" "$ARCH_REPO"/*.pkg.tar.zst
-            # repo-add makes .db and .db.sig symlinks. Release assets cannot
-            # preserve those, so replace both links with real files.
-            rm -f "$ARCH_REPO/$DB.db" "$ARCH_REPO/$DB.db.sig"
-            cp "$ARCH_REPO/$DB.db.tar.zst" "$ARCH_REPO/$DB.db"
-            cp "$ARCH_REPO/$DB.db.tar.zst.sig" "$ARCH_REPO/$DB.db.sig"
-            sha256sum "$ARCH_REPO"/*.pkg.tar.zst "$ARCH_REPO/$DB.db" \
-              > "$REPO/$DB-repo.sha256"
+            # The per-arch database is NOT built here. `edge` is a shared archive
+            # with more than one producer in it, so the database has to be
+            # read-modify-written against the live copy rather than generated
+            # fresh — packaging/arch/publish-edge.sh owns that, under a lock.
           done
           cp packaging/arch/souveraine-archive-key.asc "$REPO/"
 
       - name: Publish rolling edge prerelease
+        env:
+          # A PAT rather than the job's own GITHUB_TOKEN, so the identical
+          # invocation works from a producer repo other than this one.
+          EDGE_TOKEN: ${{ secrets.LOCAL_GITEA_TOKEN }}
+          ARCHIVE_KEY: 3CD9E99E222C2A174986FC9AFF4949AA20C8E911
         run: |
           set -euo pipefail
           cd "$GITHUB_WORKSPACE/src/Souveraine"
-          API="${GITHUB_SERVER_URL}/api/v1"
-          AUTH="Authorization: token ${{ secrets.GITHUB_TOKEN }}"
-          DESC=$(git describe --tags --always)
-
-          OLD_ID=$(curl -s -H "$AUTH" "$API/repos/${GITHUB_REPOSITORY}/releases/tags/edge" \
-            | python3 -c "import json,sys
-          try: print(json.load(sys.stdin).get('id',''))
-          except Exception: print('')")
-          if [ -n "$OLD_ID" ]; then
-            curl -s -X DELETE -H "$AUTH" "$API/repos/${GITHUB_REPOSITORY}/releases/$OLD_ID"
-            curl -s -X DELETE -H "$AUTH" "$API/repos/${GITHUB_REPOSITORY}/tags/edge"
-          fi
-
-          REL_ID=$(curl -sf -X POST -H "$AUTH" -H "Content-Type: application/json" \
-            "$API/repos/${GITHUB_REPOSITORY}/releases" \
-            -d "{\"tag_name\":\"edge\",\"target_commitish\":\"${GITHUB_SHA}\",\"name\":\"edge (${DESC})\",\"body\":\"Rolling aarch64 build of public HEAD (${GITHUB_SHA}). Built on the archdev node, published only when CI is green.\",\"prerelease\":true}" \
-            | python3 -c "import json,sys; print(json.load(sys.stdin)['id'])")
-
-          for f in souveraine-aarch64 souveraine-x86_64 souveraine-binaries.sha256 \
-            $(find "$GITHUB_WORKSPACE/pacman-repo" -type f -print); do
-            curl -sf -X POST -H "$AUTH" \
-              "$API/repos/${GITHUB_REPOSITORY}/releases/${REL_ID}/assets?name=$(basename "$f")" \
-              -F "attachment=@${f}" -o /dev/null
-          done
-          echo "published edge (${DESC}) with aarch64 package + pacman database"
+          # Additive: the release and tag are never deleted, the live databases
+          # are merged into, and only this producer's own superseded packages
+          # are removed. Before 2026-07-25 this step deleted and recreated the
+          # release, which erased every other producer's packages on each push.
+          export EDGE_TARGET_SHA="$GITHUB_SHA"
+          export PRODUCER_VERSION="0.1.r$(git rev-list --count HEAD).g${GITHUB_SHA:0:12}"
+          ./packaging/arch/publish-edge.sh souveraine "$GITHUB_WORKSPACE/pacman-repo" \
+            souveraine-aarch64 souveraine-x86_64 souveraine-binaries.sha256 \
+            "$GITHUB_WORKSPACE/pacman-repo/souveraine-archive-key.asc"
 
   # Mirror the published branch only. primary (dev) never reaches Codeberg.
   sync-codeberg: