Stop rebuilding the image every night when nothing has changed

The daily workflow already had a gate, but it could never say no: both of its
version comparisons were guaranteed to differ.

The image installs samba from trixie-security (2:4.22.10+dfsg-0+deb13u2) while
decide-build.sh read only trixie/main (...u1), so the versions never matched.
And image-info recorded the kernel as the ABI string from /boot/vmlinuz-*
(6.12.107+deb13-amd64), which is a package-name suffix, while the script
compared it against the archive's package version (6.12.107-1) — two formats
that cannot match by construction. Either one alone forced a build; together
they produced a fresh multi-hundred-megabyte release every morning for nothing.

Merge trixie, trixie-updates and trixie-security before picking the newest
version, and record kernel_version in image-info so there is something
comparable on both sides. Compare with dpkg instead of sort -V, which
mishandles epochs and tildes, and with "gt" instead of "!=" so an image that is
somehow ahead of the archive cannot spin in a rebuild loop.

Verified against the live archive and a stubbed release API: archive == image
now yields build=no, and the samba, kernel, age, first-build and
image-ahead-of-archive branches all decide correctly.

Releases published before this change carry no kernel_version, so the kernel
check is skipped for them and says so on stderr rather than passing silently.
The next build closes that gap.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/customize-samba-ad.sh.in

@@ -237,7 +237,12 @@ log "writing /etc/adc-maas/image-info"
     echo "debian_suite=${DEBIAN_SUITE}"
     echo "packer_maas_ref=${PACKER_MAAS_REF}"
     dpkg-query -W -f='${Package}=${Version}\n' samba samba-ad-dc winbind krb5-user 2>/dev/null
-    echo "kernel=$(ls -1 /boot/vmlinuz-* 2>/dev/null | sed 's|.*/vmlinuz-||' | head -1)"
+    kabi=$(ls -1 /boot/vmlinuz-* 2>/dev/null | sed 's|.*/vmlinuz-||' | head -1)
+    echo "kernel=${kabi}"
+    # The line above is the ABI string, which is a package-name suffix and only
+    # changes on an ABI bump. CI needs something it can actually compare against
+    # the archive, so record the kernel package version as well.
+    echo "kernel_version=$(dpkg-query -W -f='${Version}' "linux-image-${kabi}" 2>/dev/null || echo unknown)"
 } > /etc/adc-maas/image-info
 cat /etc/adc-maas/image-info