ci: optional apt repository per build (aptly repo.sh, matching apt.new)

[igorpecovnik]

Adds an opt-in path that builds a complete, signed apt repository with the same aptly tooling and keys production uses — tools/repository/repo.sh, the version armbian.github.io runs to build https://repo.armbian.com — so the layout matches apt.new (dists by release codename, pool by component). Groundwork for per-pull-request repositories.

Supersedes the earlier reprepro approach in this PR — switched to aptly so per-PR repos are byte-structurally identical to the production repo.

What it does

Folded into publish-debs-to-repo, reusing its single debs-to-repo-download. After the debs are downloaded (and before the rsync that moves them away):

1. checks out the build repo's tools at repo_tool_ref (the production repo.sh);
2. runs tools/repository/repo.sh -c update -k -i <output/debs[-beta]> -o output/repository → publishes dists/<release> + pool/<component> under output/repository/public, signing the top-level Release files with the keys imported above (GPG_KEY3 = Armbian repo, GPG_KEY4 = Igor);
3. rsyncs the contents of public/ to storage/repositories/<path> → served at https://repo.armbian.com/repositories/<path>.

Both steps are continue-on-error, so the optional repo can never block the raw-deb publish.

Depends on armbian/build#10304

That PR brings the production repo.sh (+ 6 review fixes) onto main. Until it lands, repo_tool_ref temporarily points at its branch singlemode-to-main so this is testable now. Once #10304 merges, set repo_tool_ref to main (then it just uses the normal build checkout).

Toggle

• build-all.yml: manual generateRepository input (default no).
• Reusable inputs: generaterepository_default (default no), repository_target_path (→ target_path), repo_tool_ref (→ singlemode-to-main).

Notes

• Only complete-artifact-matrix.yml + build-all.yml change; actionlint-clean on the touched steps.
• armbian/build#10301 / #10303 remain valid fixes for the framework's debs-to-repo-reprepro, but are no longer on this path.

[igorpecovnik]

First live test (run 30383424520, generateReprepro=yes on this branch) surfaced several issues — now addressed:

1. reprepro built nothing — the generated reprepro.sh aborted on the first missing deb (Error 2 opening ...deb → set -e before export). Partial builds always miss some debs, so this is fatal in practice. → Fixed properly in repo-reprepro: skip debs missing on disk instead of aborting the whole repo build#10301 (skip debs not present on disk). This PR depends on it.
2. Signing failed — GPG_KEY3/GPG_KEY4 were not in armbian/ci secrets (only in armbian.github.io). @igorpecovnik has since added them to armbian/ci. Also hardened here: the two keyids are trimmed so a missing import yields "" (unsigned) instead of a stray space.
3. Upload would fail — storage/repositories/<path> did not exist and rsync will not create missing parents. Now the step pre-creates the tree over ssh and skips (with a warning) when the build produced no dists/.
4. Many unauthorized ORAS fetches — that was a fresh-trunk partial state (artifacts not yet published), not a bug; ci: create + read releases in this repo (self-contained test CI) #1 makes the repo tolerant of it.

Re-test once armbian/build#10301 is merged (the reprepro job checks out build main). Still open: confirm the served storage/repositories/ path.

[igorpecovnik]

Second test run (30400943657) — the important parts now work: GPG import succeeds (both keys imported, SignWith: 1EB30FAF236099FE 93D6889F9F0E78D5), and #10301 prevents the abort (skips missing debs instead of dying).

But it produced a ~214 MB log / 7-min step. Root cause: the reprepro build ran under bash -x, which reprints the (264 KB) for one_deb in <2165 debs> header on every iteration — ~half a GB of trace for one target. Compounded by #10301 echoing one line per missing deb.

Fixes:

• here (1289417): bash -x → bash for reprepro.sh.
• repo-reprepro: log a count of skipped debs, not one line each build#10303: log a count of skipped debs per target instead of one line each.

Note: the log bloat obscured the tail, so I could not confirm export/signing/upload completed in that run — a clean re-test after both land will show it. Still open: the served storage/repositories/ path.