fix(ci): smoke test accepts http:// on Pages 301 hop (#506)

* fix(ci): smoke test allows http:// on Pages 301 hop

Phase 4a-APT's first rerun of update-apt-repo succeeded all the way
through strip + push (v2.0.3 metadata is live on gh-pages now), but
the smoke test failed at hop 0:

  Hop 0: 301 https://aaddrick.github.io/.../*.deb
         -> http://pkg.claude-desktop-debian.dev/.../*.deb
  Hop 0 mismatch: expected https://pkg..., got http://pkg...

Pages emits http:// in the Location header because https_enforced is
unsettable on the repo's Pages config: DNS for pkg.<domain> points at
Cloudflare (Worker custom_domain), so Pages can never pass domain
verification to provision its own cert. Cloudflare serves both schemes
for pkg.<domain>, so the http vs https in Pages' redirect is cosmetic
— the chain still terminates correctly.

Relax hop 0's regex in both smoke tests (update-apt-repo,
update-dnf-repo) and the heartbeat workflow to accept https?://.
Later hops stay https-only since GitHub's Release-asset redirects
are always HTTPS.

Failure was the tail-end of run 24836419696's rerun:
https://github.com/aaddrick/claude-desktop-debian/actions/runs/24836419696

Refs #493, #503

* chore: retrigger CI (previous trigger lost to GH flake)

Author: aaddrick

.github/workflows/apt-repo-heartbeat.yml

@@ -85,9 +85,11 @@ jobs:
             sleep 10
           done
 
-          # Walk redirect chain hop-by-hop, asserting each hop's pattern in order
+          # Walk redirect chain hop-by-hop, asserting each hop's pattern
+          # in order. Hop 0 may be http:// (see ci.yml smoke-test comment
+          # for the Pages https_enforced=false background).
           expected_hops=(
-            "https://${WORKER_DOMAIN}/"
+            "https?://${WORKER_DOMAIN}/"
             "https://github\\.com/aaddrick/claude-desktop-debian/releases/download/"
             "https://objects\\.githubusercontent\\.com/"
           )

.github/workflows/ci.yml

@@ -529,8 +529,13 @@ jobs:
           done
 
           # Walk redirect chain hop-by-hop
+          # Hop 0 is Pages' auto-301 from github.io to pkg.<domain>.
+          # Pages emits http:// in the Location because https_enforced
+          # can't be set (DNS points at Cloudflare, not Pages, so Pages
+          # can't provision its own cert). Cloudflare/Worker answers
+          # both schemes, so http vs https is cosmetic here.
           expected_hops=(
-            "https://${WORKER_DOMAIN}/"
+            "https?://${WORKER_DOMAIN}/"
             "https://github\\.com/aaddrick/claude-desktop-debian/releases/download/v${repoVer}\\+claude${claudeVer}/"
             "https://objects\\.githubusercontent\\.com/"
           )
@@ -738,8 +743,13 @@ jobs:
             sleep 10
           done
 
+          # Hop 0 is Pages' auto-301 from github.io to pkg.<domain>.
+          # Pages emits http:// in the Location because https_enforced
+          # can't be set (DNS points at Cloudflare, not Pages, so Pages
+          # can't provision its own cert). Cloudflare/Worker answers
+          # both schemes, so http vs https is cosmetic here.
           expected_hops=(
-            "https://${WORKER_DOMAIN}/"
+            "https?://${WORKER_DOMAIN}/"
             "https://github\\.com/aaddrick/claude-desktop-debian/releases/download/v${repoVer}\\+claude${claudeVer}/"
             "https://objects\\.githubusercontent\\.com/"
           )