fix(deb): three CodeRabbit findings on the extracted scripts

`resolve-one-deb.sh` accepted an empty `--arch`, which fell through to the
unfiltered branch and matched any .deb — silently disabling the very guard
the flag exists for. release.yml passes `"${ARCH}"` from the matrix, so an
unset ARCH could have handed an arm64 package to the job that labels it
Intel/AMD.

`smoke-deb.sh`'s cleanup did an unbounded `wait` before its KILL sweep, so
the sweep was unreachable in exactly the case it existed for: anything in
the process group ignoring SIGTERM would block the EXIT trap until the job
timeout. Same hang class this plan already fixed in the closure script, on
the same release-gating path. Now a bounded poll, then KILL, then reap.

The closure script's exit-code mapping conflated its two timeouts. Both
`timeout` calls exit 124 and the inner one propagates out as the container
status, so a launch timeout reported itself as the 900s docker budget
being exceeded — the same misdiagnosis this script was rewritten to stop
making, one layer down. The inner timeout is now remapped to 125 with its
own message.

All three verified in the shed: empty `--arch` rejected; smoke and closure
still pass on a good .deb; and the new 125 path exercised end-to-end
against the stripped-Depends .deb with a short launch budget, which
correctly reports "did not answer roostctl identify within 5s ... the
package DID install" instead of blaming the docker budget.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SgxiEBQTqgNjPswKqcs12d

Author: charliek

linux/scripts/resolve-one-deb.sh

@@ -30,6 +30,11 @@ while [ "$#" -gt 0 ]; do
       ;;
     --arch)
       [ "$#" -ge 2 ] || { usage >&2; die "--arch requires a value"; }
+      # An empty value would fall through to the unfiltered branch and match
+      # any .deb, silently disabling the guard this flag exists for.
+      # release.yml passes "${ARCH}" from the matrix, so an unset ARCH could
+      # otherwise hand an arm64 package to the job that labels it Intel/AMD.
+      [ -n "$2" ] || { usage >&2; die "--arch requires a non-empty value"; }
       arch="$2"
       shift 2
       ;;

linux/scripts/smoke-deb.sh

@@ -84,11 +84,19 @@ cleanup() {
   if [ -n "${APP}" ]; then
     # TERM the whole process group, not just $APP: $APP is the xvfb-run
     # wrapper, and reaping it does not necessarily reap the Xvfb + roost
-    # children it started. `wait` before the KILL sweep so the UI gets a
-    # chance to shut down cleanly.
+    # children it started.
     kill -TERM -- "-${APP}" 2>/dev/null || true
-    wait "${APP}" 2>/dev/null || true
+    # Poll for a clean exit on a deadline rather than a bare `wait`. An
+    # unbounded wait here would block the EXIT trap forever if anything in
+    # the group ignored SIGTERM — the same hang this script's sibling was
+    # rewritten to prevent, and on the same release-gating path. The KILL
+    # sweep has to be reachable, so it cannot sit behind the wait.
+    for _ in $(seq 1 20); do
+      kill -0 "${APP}" 2>/dev/null || break
+      sleep 0.5
+    done
     kill -KILL -- "-${APP}" 2>/dev/null || true
+    wait "${APP}" 2>/dev/null || true
   fi
   # Only ever delete a directory this script created. A caller-supplied
   # --work-dir keeps its contents — after a failure the app log in there is

linux/scripts/verify-deb-closure.sh

@@ -93,7 +93,15 @@ timeout "${DOCKER_TIMEOUT}" docker run --rm \
     # turns a finished check into a hung one.
     kill \"\$ui\" 2>/dev/null || true
     wait \"\$ui\" 2>/dev/null || true
-  "
+  " || {
+    inner=$?
+    # Re-map the inner timeout off 124. Both timeouts exit 124, and the inner
+    # one propagates out as the container status, so leaving it would make the
+    # launch timeout report itself as the outer docker budget — the same
+    # misdiagnosis this script was rewritten to stop making, one layer down.
+    [ "$inner" -eq 124 ] && { tail -40 /tmp/app.log || true; exit 125; }
+    exit "$inner"
+  }
 '
 rc=$?
 set -e
@@ -104,7 +112,10 @@ set -e
 case "${rc}" in
   0) ;;
   124)
-    die "the closure check timed out after ${DOCKER_TIMEOUT}s (docker pull, apt, or the UI launch wedged). This is a harness/environment failure, NOT evidence about the Depends: list."
+    die "the closure check exceeded its overall ${DOCKER_TIMEOUT}s budget before the UI launch was reached (docker pull or apt wedged). This is a harness/environment failure, NOT evidence about the Depends: list."
+    ;;
+  125)
+    die "the installed package did not answer roostctl identify within ${LAUNCH_TIMEOUT}s and the launch was killed. Distinct from the ${DOCKER_TIMEOUT}s budget above: the package DID install, so this points at the app or its runtime dependencies, not at docker or apt."
     ;;
   *)
     die "the .deb installed but did not come up in a clean container (exit ${rc}). The most likely cause is an incomplete Depends: list — the container has nothing preinstalled — but check the log above before concluding that: a docker or apt-mirror failure lands here too."