feat(packaging): the trial's Linux column and the Linux packages (P11a steps 1 and 3)

The Linux half of the packaging trial, run on this machine and in Debian,
Fedora and Arch containers, and the recipes it produced (docs/packaging.md
holds the table and what it found):

- mise.toml pins cargo-packager 0.11.8 and cargo-generate-rpm 0.21.1, now
  that `just package-linux` calls them. cargo-packager-updater is a
  library, not a tool, so it is not pinned (update.rs does the checking
  with minisign-verify, which is what the updater uses).
- deploy/packaging/: packager.toml (.deb, AppImage, the pacman tarball and
  its PKGBUILD), the rpm table in crates/ledger-cli/Cargo.toml, the AUR's
  own PKGBUILD (repacks the release tarball), build-linux.sh,
  repo-indexes.sh (the apt and dnf indexes, unsigned until the signing
  step), local-release.sh (a throwaway-keyed feed to try `update`),
  test-linux-packages.sh (linux_packages_install_and_upgrade: install
  0.1.0, open books as an ordinary user, upgrade to 0.1.1, check the host
  restarted onto the new file, the books' last journal line unchanged and
  `update` refuses; passes on Debian trixie, Fedora and Arch). A package
  marks itself package-managed with share/wanderbooks/install-method.
- The icon is a placeholder square (the AppImage cannot be built without
  one).
- .github/workflows/release.yml: on a version tag, build on ubuntu-24.04
  (the oldest glibc the packages claim: a program linked on this machine
  needs GLIBC_2.43 and does not start on Debian 13), attach the packages to
  the release, and add them to the apt and dnf repositories on gh-pages.
  No signing and no macOS or Windows job yet.
- The release profile strips symbols.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp

docs/architecture.md

@@ -36,7 +36,7 @@ the specification in `bookspec/` (which never depends on the engine).
 | `ledger-import` | formats: QuickBooks CSV in; IIF, XLSX, Typst PDFs (statements, the invoice, labels) out | `ledger-core`, `ledger-reader` |
 | `ledger-package` | the shared read-only view over `Store` or `Snapshot` (`PackageBooks`): the CPA package, the 1099 worksheet, the invoice document, Needs attention | `ledger-core`, `ledger-store`, `ledger-config`, `ledger-import`, `ledger-vault` |
 | `ledger-mcp` | the books server: the MCP tools (122), resources, the handbook, scopes, the door and the access log, backups' scheduling | all of the above |
-| `ledger-host` | the host and its leases, the agent bridge (`wanderbooks mcp`), tokens in 0600 files under the data root (D-63), the owner's commands, uploads and downloads | `ledger-store`, `ledger-mcp`, `ledger-config` |
+| `ledger-host` | the host and its leases, the agent bridge (`wanderbooks mcp`), tokens in 0600 files under the data root (D-63), the owner's commands, uploads and downloads, `update` and `rollback` (P11a) | `ledger-store`, `ledger-mcp`, `ledger-config` |
 | `ledger-gui` | the viewer: read-only, live, egui; the Books menu hands work to the server | `ledger-core`, `ledger-store`, `ledger-config`, `ledger-import`, `ledger-package`, `ledger-vault`, `ledger-host` |
 | `ledger-cli` | `wanderbooks`, the one executable: every mode (`serve`, `server`, `host`, `mcp`, `gui`, `setup`, `books`, `token`, `connect`, `doctor`, …) and the over-the-wire test suites | everything |
 | `bookspec/checker`, `bookspec/runner` | the example schema and parser, the rule catalogue, the `Engine` trait; the per-rule runner | nothing of ours (the adapter in `ledger-core`'s tests depends on them) |
@@ -313,3 +313,43 @@ still run on the server). The recipe, the head check for the move and the
 two-account CI job are in `deploy/README.md`, `deploy/wanderbooks-server.service`
 and `.github/workflows/two-user.yml`; the checks are
 `crates/ledger-cli/tests/two_user.rs`.
+
+## Packaging and updates (`ledger-host`'s `update.rs`, `deploy/packaging/`, P11a)
+
+One program, installed one of two ways, updated one of two ways
+(plan D-24). The install says which: a package ships
+`share/wanderbooks/install-method` beside `bin/`, and a file there makes
+the program package-managed; `wanderbooks update` and `rollback` refuse it
+and name the manager (apt, dnf and the AUR keep every release, so
+downgrading is theirs). Anything else (an AppImage, whose file is named by
+`$APPIMAGE`; an executable put somewhere by hand) updates itself:
+
+- the feed is a `manifest.json` (a version, and per platform a file's
+  address, sha256 and minisign signature; the shape `cargo-packager`'s
+  updater reads, with the sha256 added) at GitHub Releases' fixed address
+  (D-26); `--feed` reads another, and only with a `file://` feed may
+  `--trusted-key` name the key;
+- the key a release is checked against is compiled in
+  (`WANDERBOOKS_RELEASE_PUBKEY`, set by the release workflow once the
+  owner's key exists; step 5): a build without one updates from nothing;
+- a download is accepted only if its sha256 matches AND its signature
+  verifies; then it is staged, the running version kept under
+  `<root>/updates/previous/` with the journal format it understood, and the
+  file replaced by a rename of a complete copy made beside it;
+- nothing tells the books to stop. The host notices its executable's file
+  was replaced and restarts as it does for a package upgrade (host.rs
+  INVARIANT 7), finishing calls in progress; bridges reconnect upstream
+  without the agent noticing. The format gate stays the server's (3.9):
+  `rollback` refuses while a book declares a format or feature the kept
+  version does not know;
+- an AppImage is the exception to the restart: the host runs from the old
+  image's mount, whose path does not change, so it keeps running the old
+  version until the books are next closed and opened (docs/packaging.md).
+
+`deploy/packaging/` holds the Linux packaging: `packager.toml`
+(cargo-packager: `.deb`, AppImage, the pacman tarball with its PKGBUILD),
+the rpm table in `crates/ledger-cli/Cargo.toml`, `aur/PKGBUILD` (the AUR
+package, which repacks the release's tarball), `build-linux.sh`,
+`repo-indexes.sh` (the apt and dnf indexes), `local-release.sh` (a
+throwaway-keyed feed on this machine) and `test-linux-packages.sh`.
+`.github/workflows/release.yml` builds them on a version tag.