Run the apt-repo shell tests in CI

The tests SKIP when their tooling is missing so they stay usable on a bare
dev box; APT_REPO_TESTS_STRICT=1 turns that SKIP into a failure in CI, so a
missing runner package can't make the suite pass vacuously.

Author: rtibblesbot

.github/workflows/platform-apt-repo-test.yml

@@ -0,0 +1,42 @@
+name: Test the self-hosted APT repo tooling
+on:
+  pull_request:
+    paths:
+      - "platforms/apt-repo/**"
+      - "platforms/debian-server/debian/postinst"
+      - "platforms/debian-server/debian/install"
+      - "platforms/debian-server/Makefile"
+      - ".github/workflows/platform-apt-repo-test.yml"
+  push:
+    branches:
+      - develop
+    paths:
+      - "platforms/apt-repo/**"
+      - ".github/workflows/platform-apt-repo-test.yml"
+permissions:
+  contents: read
+jobs:
+  test:
+    name: Run the apt-repo shell tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7.0.0
+      - name: Install repo tooling
+        # docker is preinstalled; the container-backed tests use it. These are
+        # what the rest need, so APT_REPO_TESTS_STRICT below — which turns a
+        # missing-tool SKIP into a hard failure — leaves nothing to skip.
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends reprepro gnupg dpkg-dev rsync
+      - name: Run the apt-repo tests
+        env:
+          APT_REPO_TESTS_STRICT: "1"
+        run: |
+          for t in platforms/apt-repo/tests/*.sh; do
+            # Executable => a test; lib.sh is sourced, not run. Each test picks
+            # its own interpreter via its shebang.
+            [ -x "$t" ] || continue
+            echo "::group::$t"
+            "$t"
+            echo "::endgroup::"
+          done