fix: drop the overlay's Keel source and 1001 pin; 990 everywhere

[marcos-mendez]

Summary

Same change as the other six recipes, plus what is specific to this one, which ships its Keel source enabled.

• Overlay files dropped. The overlay no longer ships /etc/apt/sources.list.d/keel.sources or /etc/apt/preferences.d/keel (Pin-Priority 1001). At 1001, apt downgrades every package newer than the archive's (tracker#23). COVERAGE.md had already measured keel-archive-keyring 0.1.1 going back to 0.1.0. At those paths, the overlay also wins over the source and the 990 pin that fix: images take packages from Debian and the Keel repository only common#30 ships.
• conf.d/zzz-keel-archive now:
  • verifies common's source and pin and changes nothing;
  • writes the same two files on a bootstrap from before common#30 (stable enabled, trixie-testing disabled, pin 990);
  • refuses any pin priority but 990;
  • no longer runs sed 's/^Enabled: no$/Enabled: yes/' over the file, which on common's file would have enabled the testing track.
• Build-only staging pin. conf.d/main writes /etc/apt/preferences.d/keel-staging (l=Keel Linux staging, 1001) before its upgrade, so the staging archive still wins over TurnKey's 999 pin during the build. conf.d/zz-project-packages removes it with the staging source, then fails if any apt file still names the build-time archive.
• Boot test.
  • It expects the archive at 990.
  • It reads only the stable stanza of keel.sources.
  • bt_policy_verdict also passes when apt keeps an installed project package that is newer than the archive's and comes from no other source. This is the no-downgrade case: at 1001 the candidate was the archive's older version.

PR #15 conflict: a local test merge of fix/configtest-at-first-boot into this branch conflicts in COVERAGE.md only (the coverage table and the totals). changelog, conf.d/main, tests/boot-test.bats and tests/lib/boot-test-lib.sh merge cleanly.

Merge order: the seven recipes, then the pool, then common#30 together with inithooks#34.

Test plan

• bats tests/: 239 tests pass. The new and changed tests were RED first.
  • keel-archive.bats: 17 tests
  • project-packages.bats: 16 tests
  • boot-test.bats: 79 tests (4 new: common's two-stanza file, newer installed kept, older refused, newer from another source refused)
  • apt-files.bats: 3 tests
• tests/coverage.sh 97: zzz-keel-archive 100 (37/37), zz-project-packages 100 (35/35), boot-test-lib.sh 99.32 (292/294)
• CI green
• Boot gate on the next published layer (test-appliance)