Force content comparison on the local reprepro sync-up

reprepro rewrites db/*.db in place, frequently without changing the file
size or mtime (fixed-size BDB pages, sub-second rewrite). The local test
sync-up used plain `rsync -a --delete`, whose size+mtime quick-check then
skips the modified db, publishing a repo whose db is stale relative to the
freshly-exported pool/dists. This desync made the round-trip test flaky and
its AC#3 assertion pass vacuously. Add --checksum to mirror the production
gs:// leg's -c so the db is always mirrored.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: rtibblesbot

platforms/apt-repo/publish.sh

@@ -86,6 +86,11 @@ case "$KOLIBRI_APT_BUCKET" in
     gcloud storage rsync -r -c -d "$WORKDIR/repo" "$KOLIBRI_APT_BUCKET"
     ;;
   *)
-    rsync -a --delete "$WORKDIR/repo/" "$KOLIBRI_APT_BUCKET/"
+    # --checksum (mirroring the gs:// leg's -c) is required, not cosmetic:
+    # reprepro rewrites db/*.db in place, often without changing size or mtime
+    # (fixed-size BDB pages, sub-second rewrite). rsync's default size+mtime
+    # quick-check then skips the modified db, leaving the published db stale
+    # against the freshly-exported pool/dists — a silently inconsistent repo.
+    rsync -a --delete --checksum "$WORKDIR/repo/" "$KOLIBRI_APT_BUCKET/"
     ;;
 esac