feat: four-part versions, and a published version is never used again

0.2.6.1 is a maintenance release of 0.2.6. The build refused four
parts, update_canary.sh's automatic bump could not add one to "6.1", and
neither publish script would have noticed a version being published
twice — which is what happened to 0.2.6 this morning: it was rebuilt
with the Presentations hardening and uploaded over the first 0.2.6, and
a room that had installed the first can never be offered the second.

One release library now holds the version pattern (three or four parts,
no leading zeros, no .0 maintenance), orders by dpkg --compare-versions,
refuses a version that has ever been published or is not newer than all
of them, uploads with --ignore-existing and checks the server's
checksum, writes a manifest only for a package the server holds, and
reads the channel back over HTTPS afterwards. update_canary.sh takes the
version explicitly; update_stable.sh refuses to go backwards.

The classroom updater refuses a manifest whose version, package name or
checksum is malformed, and refuses a download whose own control file is
not the version the manifest promised, so a room can never loop on
reinstalling and rebooting.

tests/test-release-versions.sh: 87 checks against a stand-in server and
real dpkg. The Trixie gate now also rehearses a stable room: 0.2.2 to an
interim 0.2.6.1 upgraded with settings, channel and Presentations=false
intact, and the installed updater answering correctly.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

tools/build-release.sh

@@ -11,11 +11,10 @@ fi
 
 VERSION="$1"
 
-if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-    echo "Invalid version: $VERSION"
-    echo "Expected MAJOR.MINOR.PATCH, for example 0.1.6"
-    exit 1
-fi
+# Three parts for a feature release, four for a maintenance release of
+# one: 0.2.6, then 0.2.6.1. See tools/release-lib.sh.
+source "$ROOT/tools/release-lib.sh"
+release_require_version "$VERSION" || exit 1
 
 STAGE="$ROOT/packaging/root"
 OUTPUT="$ROOT/dist/ekklesia-classroom_${VERSION}_amd64.deb"
@@ -568,6 +567,16 @@ dpkg-deb \
     --root-owner-group \
     --build "$STAGE" "$OUTPUT"
 
+# The version dpkg reads out of the file is the one a classroom will
+# report, so it is checked rather than assumed to have survived the sed.
+built_version="$(release_package_version "$OUTPUT")"
+
+if [[ "$built_version" != "$VERSION" ]]; then
+    echo "The package says it is $built_version, not $VERSION" >&2
+    rm -f "$OUTPUT"
+    exit 1
+fi
+
 echo
 echo "Built:"
 echo "$OUTPUT"