apt: round-trip sources in place instead of consolidating them into sources.list

Saving the modified source entries with save_legacy rewrote every entry
into /etc/apt/sources.list in legacy format, destroying deb-src entries
and signed-by/trusted options, duplicating every distro entry that came
from a deb822 file (which stayed in place), and hardcoding the Ubuntu
keyring on cross builds. Entries now remember the file and format they
were loaded from and are written back there; new entries (PPAs, ports)
go to a pkh-owned /etc/apt/sources.list.d/pkh-added.list, and a one-time
<path>.pkh-backup copy is made before overwriting an existing file.

Also fixes: 'Types: deb deb-src' stanzas are split instead of being
treated as binary-only, commented-out legacy entries are kept disabled
instead of deleted, debian.sources is actually read on Debian (the old
else-if never fired), and the double blank lines save_legacy emitted.

src/deb/local.rs

@@ -107,10 +107,15 @@ pub async fn build(
 
                     let new_source = crate::apt::sources::SourceEntry {
                         enabled: true,
+                        kind: crate::apt::sources::SourceKind::Deb,
                         components: vec!["main".to_string()],
                         architectures: architectures.clone(),
+                        signed_by: None,
+                        trusted: None,
                         suite: suites,
                         uri: base_url,
+                        // No origin: saved to the pkh-owned added-sources file
+                        origin: None,
                     };
                     sources.push(new_source);
                     modified = true;
@@ -159,7 +164,9 @@ pub async fn build(
     }
 
     if modified {
-        apt::sources::save_legacy(Some(ctx.clone()), sources, "/etc/apt/sources.list")?;
+        // Each entry is written back to its origin file in its own format;
+        // new PPA entries go to the pkh-owned added-sources file
+        apt::sources::save(Some(ctx.clone()), sources)?;
 
         // Download and import PPA keys for all added PPAs
         for (user, ppa_name) in added_ppas {