fix: drop the overlay's Keel source and 1001 pin; pin staging for the build only

[marcos-mendez]

Summary

• Overlay files dropped. The overlay no longer ships /etc/apt/sources.list.d/keel.sources (apt.keellinux.org, disabled) or /etc/apt/preferences.d/keel (Pin-Priority 1001).
  • At 1001, apt downgrades every package newer than the archive's (tracker#23).
  • At those paths, a recipe overlay wins over the source and the 990 pin that fix: images take packages from Debian and the Keel repository only common#30 ships. common#30's conf/turnkey.d/keel-apt therefore stops this build until this lands.
• The 1001 pin had a second job. It let the build-time staging archive (Origin "Keel Linux") win over TurnKey's o=turnkeylinux pin at 999 when conf.d/main upgrades inithooks and confconsole. Without it, apt would pick TurnKey's 2.3.6. So conf.d/main now writes /etc/apt/preferences.d/keel-staging:
  • Pin: release l=Keel Linux staging, at 1001, written just before the upgrade;
  • removed together with keel-staging.list (common#30's final removelist removes it too);
  • pinned by Label, so common#30's "Keel pin must be 990" check does not match it.
• New leftover check. The old grep -q '^Enabled: no' keel.sources becomes: fail the build if any apt source or pin of the image still names the build-time archive (trixie-staging, /srv/keel-apt, l=Keel Linux staging). This holds on today's common, where the image has no Keel source, and on common#30, where common ships it enabled.

Merge order: this PR, then the pool, then common#30 together with inithooks#34.

Test plan

• tests/apt-files.bats (5 tests, RED first): neither overlay file, the staging pin written before the upgrade and removed right after the staging list, the leftover check in place, conf.d/main parses. conf.d/main itself runs only in a build chroot, so these are static checks.
• CI green
• The next build's boot test: the image has neither file nor any staging pin, and inithooks/confconsole are still the staging versions.