deb: pin proposed pocket when building against it

'proposed' pockets are marked 'NotAutomatic' in their Release file,
which gives them an apt priority of 1: apt would ignore them during
build-dependency resolution even when the suite is enabled.

Write an apt preferences entry pinning '{series}-proposed' at
priority 600 so build-dependencies are actually resolved from the
requested pocket.

src/deb/local.rs

@@ -128,6 +128,19 @@ pub async fn build(
                 modified = true;
             }
         }
+
+        // 'proposed' pockets are marked 'NotAutomatic' in their Release file,
+        // giving them an apt priority of 1: without an explicit pin, apt
+        // would ignore them even when enabled
+        if pocket_name.starts_with("proposed") {
+            let pin_path = format!("/etc/apt/preferences.d/pkh-{}", pocket_suite);
+            let pin_content = format!(
+                "Package: *\nPin: release a={}\nPin-Priority: 600\n",
+                pocket_suite
+            );
+            log::info!("Pinning pocket '{}' with priority 600", pocket_suite);
+            ctx.write_file(Path::new(&pin_path), &pin_content)?;
+        }
     }
 
     if modified {