Invoke publish.sh via bash in its round-trip test

publish.sh is a bash script (set -o pipefail), but the test invoked it via
`sh`, which aborts under a dash that lacks pipefail — as on the CI runner,
though not the newer dash in the test container. The publish workflow already
runs it via bash; match that. Same bug class as the seed-test fix.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: rtibblesbot

platforms/apt-repo/tests/test_publish_roundtrip.sh

@@ -64,8 +64,8 @@ mkdir -p "$BUCKET"
 export KOLIBRI_APT_BUCKET="$BUCKET"
 
 # --- two sequential publishes -----------------------------------------------
-sh "$PUBLISH" "$WORK/aaa-test_1.0_all.deb"
-sh "$PUBLISH" "$WORK/bbb-test_1.0_all.deb"
+bash "$PUBLISH" "$WORK/aaa-test_1.0_all.deb"
+bash "$PUBLISH" "$WORK/bbb-test_1.0_all.deb"
 
 # --- AC#3: both present after the second publish ----------------------------
 PKGS="$BUCKET/dists/stable/main/binary-amd64/Packages"
@@ -79,7 +79,7 @@ grep -q "^Package: bbb-test$" "$PKGS" || { echo "FAIL: bbb-test missing after se
 [ -f "$BUCKET/pubkey.asc" ] || { echo "FAIL: pubkey.asc not served at bucket root"; exit 1; }
 
 # --- bootstrap-root path: kolibri-archive-keyring.deb at bucket root ---------
-KOLIBRI_KEYRING_DEB="$WORK/aaa-test_1.0_all.deb" sh "$PUBLISH" "$WORK/aaa-test_1.0_all.deb"
+KOLIBRI_KEYRING_DEB="$WORK/aaa-test_1.0_all.deb" bash "$PUBLISH" "$WORK/aaa-test_1.0_all.deb"
 [ -f "$BUCKET/kolibri-archive-keyring.deb" ] \
   || { echo "FAIL: kolibri-archive-keyring.deb not served at bucket root"; exit 1; }
 
@@ -105,8 +105,8 @@ EOF
 }
 build_keyring_variant a
 build_keyring_variant b
-KOLIBRI_KEYRING_DEB="$WORK/kr-keyring-a.deb" sh "$PUBLISH" "$WORK/aaa-test_1.0_all.deb"
-KOLIBRI_KEYRING_DEB="$WORK/kr-keyring-b.deb" sh "$PUBLISH" "$WORK/aaa-test_1.0_all.deb" \
+KOLIBRI_KEYRING_DEB="$WORK/kr-keyring-a.deb" bash "$PUBLISH" "$WORK/aaa-test_1.0_all.deb"
+KOLIBRI_KEYRING_DEB="$WORK/kr-keyring-b.deb" bash "$PUBLISH" "$WORK/aaa-test_1.0_all.deb" \
   || { echo "FAIL: keyring re-publish aborted on a rebuilt same-version .deb"; exit 1; }
 
 echo "PASS: round-trip preserves prior packages; Release signed; pubkey.asc + bootstrap deb served"