deb: pin proposed pocket when building against it

'proposed' pockets are marked 'NotAutomatic' in their Release file,
which gives them an apt priority of 1: apt would ignore them during
build-dependency resolution even when the suite is enabled.

Write an apt preferences entry pinning '{series}-proposed' at
priority 600 so build-dependencies are actually resolved from the
requested pocket.

src/deb/cross.rs

@@ -104,7 +104,7 @@ pub fn ensure_repositories(
     if !has_ports {
         // Add ports repository for the target architecture
         let mut ports_suites = vec![
-            series.to_string(),
+            format!("{series}"),
             format!("{series}-updates"),
             format!("{series}-backports"),
             format!("{series}-security"),

src/deb/local.rs

@@ -82,7 +82,7 @@ pub async fn build(
                     }
 
                     // Create suite list with all Ubuntu series
-                    let suites = vec![series.to_string()];
+                    let suites = vec![format!("{}", series)];
 
                     let new_source = crate::apt::sources::SourceEntry {
                         enabled: true,
@@ -133,7 +133,13 @@ pub async fn build(
         // giving them an apt priority of 1: without an explicit pin, apt
         // would ignore them even when enabled
         if pocket_name.starts_with("proposed") {
-            pin_pocket(&pocket_suite, &ctx)?;
+            let pin_path = format!("/etc/apt/preferences.d/pkh-{}", pocket_suite);
+            let pin_content = format!(
+                "Package: *\nPin: release a={}\nPin-Priority: 600\n",
+                pocket_suite
+            );
+            log::info!("Pinning pocket '{}' with priority 600", pocket_suite);
+            ctx.write_file(Path::new(&pin_path), &pin_content)?;
         }
     }
 
@@ -338,24 +344,6 @@ fn apply_quilt_patches(
     Ok(())
 }
 
-/// Pin a 'NotAutomatic' pocket (e.g. '-proposed') so apt takes it into
-/// account during dependency resolution.
-///
-/// Apt preferences are global: a single 'release' pin matches the pinned
-/// suite on every repository carrying it (archive, security and ports),
-/// for all architectures, so this also covers cross-builds pulling
-/// dependencies from 'ports.ubuntu.com'.
-fn pin_pocket(pocket_suite: &str, ctx: &Arc<Context>) -> Result<(), Box<dyn Error>> {
-    let pin_path = format!("/etc/apt/preferences.d/pkh-{}", pocket_suite);
-    let pin_content = format!(
-        "Package: *\nPin: release a={}\nPin-Priority: 600\n",
-        pocket_suite
-    );
-    log::info!("Pinning pocket '{}' with priority 600", pocket_suite);
-    ctx.write_file(Path::new(&pin_path), &pin_content)?;
-    Ok(())
-}
-
 fn install_injected_packages(
     packages: &[&str],
     env: &HashMap<String, String>,