fix(ci): preserve Debian apt package archives in linux-stage-zero

.github/workflows/verify.yml

@@ -298,7 +298,7 @@ jobs:
         include:
           - image: debian:stable-slim
             pkg_cache: /var/cache/apt/archives
-            prereqs: apt-get update -qq && apt-get install -y -qq sudo golang-go git ca-certificates curl
+            prereqs: rm -f /etc/apt/apt.conf.d/docker-clean && echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache && apt-get update -qq && apt-get install -y -qq sudo golang-go git ca-certificates curl
           - image: archlinux:base
             pkg_cache: /var/cache/pacman/pkg
             # DisableSandbox under [options], and it must be under [options]:

docs/design/2026-08-29-ci-debian-package-cache-fix.md

@@ -0,0 +1,39 @@
+# Spec: Debian Container Package Cache Fix
+
+**Date:** 2026-08-29  
+**Status:** Approved design, entering implementation  
+**Author:** Pair Programming Session (Superpowers)  
+**Related Design Documents:**
+- [CI Latency and Test Harness Optimization (Phase 2)](2026-08-29-ci-latency-and-test-harness-optimization-phase-2.md)
+- [Spec 5 — verification gate](2026-08-11-spec-5-verification-gate.md)
+
+---
+
+## 1. Problem Statement
+
+In `linux-stage-zero` container jobs in `.github/workflows/verify.yml`, `actions/cache` was configured to cache `/var/cache/apt/archives` on Debian and `/var/cache/pacman/pkg` on Arch Linux.
+
+While Arch Linux successfully saved and restored ~195 MB of package archives, Debian saved only 394 bytes (an empty directory metadata tarball).
+
+**Root Cause:**
+Official Docker Debian images (`debian:stable-slim`) ship with a default `/etc/apt/apt.conf.d/docker-clean` configuration that hooks `DPkg::Post-Invoke` and `APT::Update::Post-Invoke` to automatically delete all `.deb` archives in `/var/cache/apt/archives/` after every `apt-get` execution.
+
+---
+
+## 2. Solution
+
+In `.github/workflows/verify.yml`, update the Debian matrix entry under `linux-stage-zero` to remove `/etc/apt/apt.conf.d/docker-clean` and configure APT to keep downloaded archives:
+
+```yaml
+          - image: debian:stable-slim
+            pkg_cache: /var/cache/apt/archives
+            prereqs: rm -f /etc/apt/apt.conf.d/docker-clean && echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache && apt-get update -qq && apt-get install -y -qq sudo golang-go git ca-certificates curl
+```
+
+---
+
+## 3. Invariants & Verification
+
+1. **Clean Container Fidelity:** `stageZero` in `packages.go` continues to run real package installations and verify required tool binaries (`gcc`, `file`, etc.).
+2. **Security & Pinning:** `actions/cache` remains pinned to `55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0`.
+3. **Workflow Syntax:** Workflow YAML syntax validated.

docs/plans/2026-08-29-ci-debian-package-cache-fix.md

@@ -0,0 +1,45 @@
+# Debian Container Package Cache Fix Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Ensure Debian `.deb` packages are retained in `/var/cache/apt/archives` during `linux-stage-zero` container runs so that `actions/cache` can save and restore them across workflow runs.
+
+**Architecture:** In `.github/workflows/verify.yml`, remove `/etc/apt/apt.conf.d/docker-clean` and set `Binary::apt::APT::Keep-Downloaded-Packages "true"` in Debian's `prereqs` matrix string before executing `apt-get`.
+
+**Tech Stack:** GitHub Actions YAML, Debian APT, `actions/cache@v6.1.0`
+
+**Spec:** [docs/design/2026-08-29-ci-debian-package-cache-fix.md](file:///Users/nilbot/dotfiles/docs/design/2026-08-29-ci-debian-package-cache-fix.md)
+
+---
+
+### Task 1: Update Debian Prerequisites in `.github/workflows/verify.yml`
+
+**Files:**
+- Modify: `.github/workflows/verify.yml:295-310`
+
+- [ ] **Step 1: Update Debian `prereqs` in `linux-stage-zero` matrix**
+
+In `.github/workflows/verify.yml`:
+```yaml
+          - image: debian:stable-slim
+            pkg_cache: /var/cache/apt/archives
+            prereqs: rm -f /etc/apt/apt.conf.d/docker-clean && echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache && apt-get update -qq && apt-get install -y -qq sudo golang-go git ca-certificates curl
+```
+
+- [ ] **Step 2: Commit workflow changes**
+
+```bash
+git add .github/workflows/verify.yml
+git commit -m "ci(verify): preserve Debian apt package archives in linux-stage-zero"
+```
+
+---
+
+### Task 2: Verification
+
+**Files:**
+- Verification only
+
+- [ ] **Step 1: Validate YAML and run local tests**
+Run: `(cd agents && go test -count=1 ./...) && (cd bootstrap.d && go test -count=1 ./...)`
+Expected: PASS