[patch] Preserve the shared rolling package repository

[libops-agent]

Outcome

Keep core sitectl and every sitectl-* plugin in the existing shared /sitectl APT/RPM repository and signing key while bounding GCS storage to the current package set.

Changes

• sync the complete current shared repository under the existing publish lock
• replace only the releasing package with stable architecture-specific artifacts
• regenerate APT and RPM metadata from all current core/plugin packages
• delete objects absent from the rebuilt repository after replacement metadata is live
• document the one-source/one-keyring and latest-only storage invariants in AGENTS.md and the operator README

Validation

• all repository shell contract tests
• bash -n scripts/publish-package-repo.sh
• terraform fmt -check -recursive
• Markdown skill validation for the matching sitectl-expert guidance

Further plugin merges remain paused until this publisher is merged, adopted by the shared workflow, and a clean install from the single existing APT source passes.