Add linux-headers-bbrv3 meta so DKMS builds and ZFS-root boots

The kernel shipped image-only: install.sh installed just linux-image-bbrv3,
which pulled no headers, so DKMS (zfs-dkms) had no build tree and never built
zfs.ko for the new kernel. On a ZFS-on-root box that left zfs out of the
initramfs -> root could not be mounted -> the machine failed to boot
(hit live on baguette; maple/wunder are ext4-root so they booted but ran
docker on an unimported, empty rpool).

Permanent fix:
- build-meta-package.sh now also builds a linux-headers-bbrv3 meta (amd64) and
  makes linux-image-bbrv3 Depend on it, so headers always install in the same
  apt transaction as the kernel and DKMS rebuilds on every upgrade (mirrors
  Debian's linux-image-amd64 / linux-headers-amd64 pair). arm64 ships no headers
  (nokernelheaders cross build), so the dep and meta are amd64-only.
- build.yml derives the headers package name and passes it to the meta builder.
- registry-has-all.sh counts the headers meta as part of a complete publish.
- install.sh installs linux-headers-bbrv3 alongside the image (latest path) and
  the matching versioned headers in the specific-version path.

Also bundles pre-existing WIP: docs/README notes on the two-stage (Cloudflare
edge + origin nginx) upload body-limit, and setup_apt_source key-download
HTTP-status error handling.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/superpowers/specs/2026-06-17-apt-repo-migration-design.md

@@ -58,10 +58,13 @@
 - CI 需 `PKG_TOKEN` secret（有 `write:package` scope）；自动注入的 `GITHUB_TOKEN` 不保证有
   包写权限。
 - registry 保留历史版本以支撑「装指定版本」；将来再议 retention。
-- **上传路径不能经过有 body 上限的 CDN**（落地后实测补记）：`git.chilldove.com` 对境外
-  runner 走 Cloudflare（orange-cloud），CF 免费/Pro 版 100 MB 请求体上限会把 >100 MB 的内核
-  镜像 `.deb` 在边缘 413（源站 Baguette 实测可收 ≥110 MB）。CI 须配 Gitea 仓库变量
-  `PKG_ORIGIN_IP`，发布步骤用 `curl --resolve` 直连源站绕过 CF。详见
+- **上传路径有两道串联的 body 上限，缺一不可**（落地后实测补记）：内核镜像 `.deb` >128 MB，
+  两道任一都会 413。第①道 CDN 边缘：`git.chilldove.com` 对境外 runner 走 Cloudflare
+  （orange-cloud），CF 免费/Pro 版 100 MB 请求体上限在边缘 413。配 Gitea 仓库变量
+  `PKG_ORIGIN_IP`，发布步骤用 `curl --resolve` 直连源站 `51.77.132.151` 绕过 CF。但绕过 CF 后
+  又撞第②道源站反代：Baguette 源站 nginx `client_max_body_size` 实测仅 **128m**（128 MiB 收、
+  129 MiB 413），>128 MB 的 deb 仍 413。修法是把源站 vhost 调高（已改 `client_max_body_size
+  1G`，实测 1100 MB 才 413）。两道都过才发得上。详见
   [[工程实践/案例/2026-06-17 Gitea Debian registry 上传被 Cloudflare 100MB body 上限 413]]。
 
 ## 不做（YAGNI）