deb: share the apt download cache across builds

With the chroot now per-run scratch, every build re-downloaded the
packages its dependency install needed — the very cost the chroot reuse
used to hide. Every chroot's /var/cache/apt/archives is now a bind
mount over a shared cache at /var/tmp/pkh/apt-cache/<series>-<arch>/
(the chroot's architecture, like the tarball cache), which one run's
installs fill and the next runs reuse: apt keeps downloaded packages
through a dropped conf (APT::Keep-Downloaded-Packages), and an
apt-get autoclean at the end of each run drops the debs the archive no
longer serves. pkh prune removes caches untouched for a week.

The run holds a host-side flock on the cache for its whole lifetime:
apt's own archives lock is acquired inside the chroot's pid namespace,
where a concurrent build's apt shows the holder as "process 0" — an
invisible process it refuses to wait for — so pkh serializes the
traffic itself; concurrent builds of the same target wait for each
other. Any bind-mount failure falls back to the chroot's own cache
with a warning (correct, just slower), and the temp-chroot teardown now
unmounts everything under the chroot before rm -rf, so the removal can
never reach through the cache bind mount and delete the shared cache
itself.

README.md

@@ -132,6 +132,14 @@ so records stay small. What `--incremental` buys is the record's
 **staged tree** (`tree-upper/`): the overlay upperdir where the build's
 writes land, holding the compiled objects.
 
+Fresh chroots do not mean fresh downloads: every chroot's
+`/var/cache/apt/archives` is a bind mount over a shared apt download
+cache at `/var/tmp/pkh/apt-cache/<series>-<arch>/`, which the installs
+of one run fill and the next runs reuse (apt is configured to keep the
+downloaded packages, and an `apt-get autoclean` at the end of each run
+drops the debs the archive no longer serves). `pkh prune` removes the
+caches untouched for a week.
+
 `--incremental` forks a previous record — a copy, the base is never
 modified — so a failed run can never destroy the last-good state it was
 built from. The staged tree is carried only when the base's recorded