[andrescera]

What

Flips the ModemManager-stack .deb build from debian:bookworm to debian:trixie — the
suite the device image actually runs — and finalizes the first-party package versions for
the v1.4.0 release.

• packaging/ci/build-bookworm.sh → build-stack.sh, with the build container
  parameterized as debian:$TARGET_SUITE (default trixie).
• The companion test seam and the adaptations doc follow the rename:
  BUILD_BOOKWORM_* → BUILD_STACK_*, packaging/BOOKWORM-ADAPTATIONS.md →
  packaging/SUITE-ADAPTATIONS.md.
• The packaging CI lane, the contract suite, the daemon smoke, the companion build and
  cli/smoke/run.sh all move to trixie with it.
• New fail-closed build-suite parity gate: the container's own VERSION_CODENAME must
  equal TARGET_SUITE, or the build is refused.
• package.json / control/package.json / cli/package.json (+ the two bun.lock
  workspace mirrors) go to 1.4.0.

Why

A stack built against a newer libc than the board ships fails at load with a GLIBC_
symbol error that no build step can observe — the mismatch surfaces only on a device. That
is the same defect class as the recent cerastream glibc hotfix, and the root standard asks
for suite parity to be a gate rather than a convention. It now is one, and it fired
during the real build.

Why the debian/ recipes are unchanged — the counter-intuitive part. The tempting move
is to revert the bookworm adaptations now that trixie is closer to the pinned sid
packaging. Re-measured in a debian:trixie container, that is wrong: trixie moved both
udev.pc and systemd.pc into systemd-dev, so the udev build-dep supplies neither
and the two meson install-dir pins are more load-bearing than they were on bookworm. The
GI substitution also still resolves (libgirepository1.0-dev is current at 1.84.0-1), so
reverting it would re-open a verified deviation surface for no gain. All four adapted
controls resolve on trixie (apt-get build-dep --dry-run, exit 0). The reasoning is
recorded in the rewritten packaging/SUITE-ADAPTATIONS.md.

Two genuine trixie deltas are fixed, both found by executing rather than by review:

• daemon-smoke.sh installed policykit-1, which does not exist on trixie (it is a
  bookworm transitional package). It now installs polkitd.
• test-package-contract.sh hardcoded STOCK_MM_UPSTREAM=1.20.4 (bookworm). Trixie stock
  ModemManager is 1.24.0-1+deb13u1, so CHECK 3 was silently degrading to a generic note
  instead of asserting the real 1.24.0 → 1.24.2 upgrade. Now 1.24.0, env-overridable.

No rebuild counter is edited here, because none is tracked. ~ceralive.N is injected
at build time by inject-deb-version.sh from the previous release manifest;
packaging/<Source>/debian/changelog holds pristine salsa changelogs with no ~ceralive
suffix at all. Touching packaging/ci/** is a shared build input, so change detection
emits mode=force-all and every source derives its own next counter — .2 → .3 against
the published v1.3.0 manifest. The companion is outside that scheme entirely and is
unaffected. closure_version stays 2.

The version bump is a precondition rather than a consequence: publish-npm verifies
(never injects) that all three manifests equal the tag's X.Y.Z, and fails closed
otherwise.

How to verify

Packaging, in a debian:trixie container (all run here, amd64, green):

bash packaging/ci/contract.sh                      # contract lane
bash packaging/ci/build-stack.sh amd64             # 27 debs, 9-package runtime closure
bash packaging/ci/test-package-contract.sh amd64   # 8/8, incl. the real 1.24.0 -> 1.24.2 upgrade
bash packaging/ci/daemon-smoke.sh amd64            # GI typelib via PyGObject + Vala ABI on trixie
bash packaging/ci/build-companion.sh               # one Architecture: all deb
bash packaging/ci/test-companion-chroot.sh         # 35/35

Workspace lane:

bun install --frozen-lockfile   # passes with the updated bun.lock
bun run lint                    # biome check, 410 files, clean
bun run typecheck               # tsc --noEmit, clean
bun test                        # 1492 pass / 0 fail

Parity gate (should REFUSE):

TARGET_SUITE=bookworm bash packaging/ci/build-stack.sh amd64   # container codename != TARGET_SUITE

Risks

• arm64 is unproven locally. QEMU full-system emulation was not run here, so the arm64
  leg of the release build is demonstrated for the first time in the release workflow's
  build-deb job. Everything verified above is amd64. Build-deps for all four recipes do
  resolve on trixie/arm64, but resolving is not building.
• The first release built on trixie is also the first differential release to carry all
  four sources at ~ceralive.3. The derivation is proven end-to-end against the published
  v1.3.0 manifest (detector on the real post-commit diff; inject-deb-version.sh →
  .3 for all four; companion untouched), but a real release run is what confirms it.
• Reverting is a single-commit revert: nothing in the debian/ recipes changed, so there
  is no packaging state to unwind — only the build container and the CI lane move back.