The pacstall installer has its own dep install logic that handles edge
cases (e.g. debian-trixie dropped spdx-licenses from apt, so the
installer has a fallback to fetch the .deb directly from
ftp.debian.org and install via 'apt install /path/to/deb'). My script
was duplicating that logic with a strict apt-get install that failed
because spdx-licenses isn't in trixie apt.
Fix: install only the absolute minimum (curl, wget, ca-certificates,
sudo) so the installer can fetch and verify its own deps. Trust the
installer.
Three changes:
1. NEW run_once_05-install-pacstall.sh.tmpl (debian-only)
Installs pacstall via its official installer. Pacstall is an
AUR-like package manager for debian/ubuntu, with neovim at
0.12.2-1 (current as of bootstrap). The installer requires
root and prompts for 'install axel?', so we run it under
sudo with NON_INTERACTIVE=true and stdin redirected from /dev/null.
2. UPDATE run_once_20-install-user-packages.sh.tmpl
On debian, prefer pacstall over the GitHub tarball when
pacstall is available. The tarball fallback remains for the
case where pacstall install failed or isn't wanted.
3. NEW dot_config/topgrade/topgrade.toml
Topgrade's built-in pacstall step auto-detects pacstall and
runs 'pacstall -U -Up' (update repo + upgrade packages).
Built-in chezmoi step also auto-detects chezmoi. So our
topgrade config just sets pre_sudo=true for password caching
and ignore_failures for node.
