Add linux-headers-bbrv3 meta so DKMS builds and ZFS-root boots

The kernel shipped image-only: install.sh installed just linux-image-bbrv3,
which pulled no headers, so DKMS (zfs-dkms) had no build tree and never built
zfs.ko for the new kernel. On a ZFS-on-root box that left zfs out of the
initramfs -> root could not be mounted -> the machine failed to boot
(hit live on baguette; maple/wunder are ext4-root so they booted but ran
docker on an unimported, empty rpool).

Permanent fix:
- build-meta-package.sh now also builds a linux-headers-bbrv3 meta (amd64) and
  makes linux-image-bbrv3 Depend on it, so headers always install in the same
  apt transaction as the kernel and DKMS rebuilds on every upgrade (mirrors
  Debian's linux-image-amd64 / linux-headers-amd64 pair). arm64 ships no headers
  (nokernelheaders cross build), so the dep and meta are amd64-only.
- build.yml derives the headers package name and passes it to the meta builder.
- registry-has-all.sh counts the headers meta as part of a complete publish.
- install.sh installs linux-headers-bbrv3 alongside the image (latest path) and
  the matching versioned headers in the specific-version path.

Also bundles pre-existing WIP: docs/README notes on the two-stage (Cloudflare
edge + origin nginx) upload body-limit, and setup_apt_source key-download
HTTP-status error handling.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/build.yml

@@ -18,13 +18,16 @@ env:
   # https://git.chilldove.com/api/packages/icePigeon/debian
   PKG_REGISTRY: ${{ github.server_url }}/api/packages/${{ github.repository_owner }}/debian
   PKG_USER: ${{ github.repository_owner }}
-  # Optional origin pin for uploads. The kernel image .deb is >100 MB, which trips
-  # the request-body cap of a CDN/proxy fronting the registry (Cloudflare free/pro
-  # caps at 100 MB and returns 413 at the edge, before the body reaches Gitea — the
-  # origin itself accepts it). Set the Gitea repo/org variable PKG_ORIGIN_IP to the
-  # registry origin's address (the host behind the CDN) and the publish step pins the
-  # upload straight there via curl --resolve, bypassing the CDN. vars (unlike secrets)
-  # ARE available to workflow-level env. Leave empty if no CDN fronts uploads.
+  # Optional origin pin for uploads. The kernel image .deb is >128 MB and a 413 can
+  # come from TWO request-body caps in series: (1) a CDN fronting the registry
+  # (Cloudflare free/pro = 100 MB, rejected at the edge before the body reaches the
+  # origin) and (2) the origin reverse proxy's own client_max_body_size (e.g. nginx).
+  # Set the Gitea repo/org variable PKG_ORIGIN_IP to the registry origin's address
+  # (the host behind the CDN) and the publish step pins the upload straight there via
+  # curl --resolve, bypassing cap (1). Cap (2) is server-side: the origin proxy must
+  # allow client_max_body_size >= the .deb size, or it still 413s after the bypass.
+  # vars (unlike secrets) ARE available to workflow-level env. Leave empty if no CDN
+  # fronts uploads.
   PKG_ORIGIN_IP: ${{ vars.PKG_ORIGIN_IP }}
   # NOTE: PKG_TOKEN (the write:package secret) is declared at JOB level below. The
   # secrets context is not available to workflow-level env, so a value set here
@@ -294,7 +297,20 @@ jobs:
           img_pkg=$(dpkg-deb -f "$img_deb" Package)
           echo "Kernel image package: $img_pkg"
 
-          bash scripts/build-meta-package.sh "$KERNEL_VERSION" "$DEB_ARCH" "$img_pkg" ./out
+          # Headers package: present on amd64, absent on the arm64 (nokernelheaders)
+          # cross build. When present, build-meta-package.sh emits a linux-headers-bbrv3
+          # meta and makes linux-image-bbrv3 depend on it, so DKMS (e.g. ZFS) always has
+          # a build tree and the box can't end up image-only / unbootable.
+          hdr_deb=$(find ./kernel -maxdepth 1 -name 'linux-headers-*.deb' ! -name '*-dbg*' | sort | head -n1)
+          hdr_pkg=""
+          if [ -n "$hdr_deb" ]; then
+            hdr_pkg=$(dpkg-deb -f "$hdr_deb" Package)
+            echo "Kernel headers package: $hdr_pkg"
+          else
+            echo "No linux-headers .deb (expected on arm64); headers meta skipped."
+          fi
+
+          bash scripts/build-meta-package.sh "$KERNEL_VERSION" "$DEB_ARCH" "$img_pkg" ./out "$hdr_pkg"
 
           # bbrv3-config is Architecture:all; build it once (on the primary arch).
           if [ "$IS_PRIMARY" = "true" ]; then
@@ -322,12 +338,13 @@ jobs:
             exit 1
           fi
 
-          # The kernel image .deb is >100 MB, which trips the request-body cap of a
-          # CDN/proxy in front of the registry (Cloudflare free/pro = 100 MB) and 413s
-          # at the edge before the body reaches Gitea — the origin itself accepts it.
-          # If PKG_ORIGIN_IP is set, pin the upload straight to that origin so the
-          # oversized PUT never touches the CDN. SNI/Host stay $reg_host, so TLS and
-          # package routing are unchanged; only the TCP connect target moves.
+          # The kernel image .deb is >128 MB and can 413 on either of two body caps:
+          # a CDN edge (Cloudflare free/pro = 100 MB) and the origin proxy's own
+          # client_max_body_size. If PKG_ORIGIN_IP is set, pin the upload straight to
+          # that origin so the oversized PUT never touches the CDN (clears the edge
+          # cap). SNI/Host stay $reg_host, so TLS and package routing are unchanged;
+          # only the TCP connect target moves. The origin proxy must still be
+          # configured to accept the .deb size, or it 413s even after the bypass.
           reg_host=${PKG_REGISTRY#*://}; reg_host=${reg_host%%/*}
           resolve=()
           if [ -n "${PKG_ORIGIN_IP:-}" ]; then