deb: pin proposed pocket when building against it

'proposed' pockets are marked 'NotAutomatic' in their Release file,
which gives them an apt priority of 1: apt would ignore them during
build-dependency resolution even when the suite is enabled.

Write an apt preferences entry pinning '{series}-proposed' at
priority 600 so build-dependencies are actually resolved from the
requested pocket.

src/deb/local.rs

@@ -128,6 +128,19 @@ pub async fn build(
                 modified = true;
             }
         }
+
+        // 'proposed' pockets are marked 'NotAutomatic' in their Release file,
+        // giving them an apt priority of 1: without an explicit pin, apt
+        // would ignore them even when enabled
+        if pocket_name.starts_with("proposed") {
+            let pin_path = format!("/etc/apt/preferences.d/pkh-{}", pocket_suite);
+            let pin_content = format!(
+                "Package: *\nPin: release a={}\nPin-Priority: 600\n",
+                pocket_suite
+            );
+            log::info!("Pinning pocket '{}' with priority 600", pocket_suite);
+            ctx.write_file(Path::new(&pin_path), &pin_content)?;
+        }
     }
 
     if modified {
@@ -198,6 +211,9 @@ pub async fn build(
         .to_str()
         .ok_or("Invalid package directory path")?;
 
+    // Apply quilt patches if the package provides a patch series
+    apply_quilt_patches(package_dir_str, &env, ctx.clone())?;
+
     // Install injected packages if specified
     if let Some(packages) = inject_packages {
         install_injected_packages(packages, &env, ctx.clone())?;
@@ -268,6 +284,66 @@ pub async fn build(
     Ok(())
 }
 
+/// Apply quilt patches before building, if the package provides a
+/// 'debian/patches/series' file
+fn apply_quilt_patches(
+    package_dir: &str,
+    env: &HashMap<String, String>,
+    ctx: Arc<Context>,
+) -> Result<(), Box<dyn Error>> {
+    let series_path = Path::new(package_dir).join("debian/patches/series");
+    if !ctx.exists(&series_path)? {
+        log::debug!(
+            "No '{}' found, skipping quilt patch application",
+            series_path.display()
+        );
+        return Ok(());
+    }
+
+    // Skip patch application if the series file contains no patches
+    let series_content = ctx.read_file(&series_path)?;
+    let has_patches = series_content
+        .lines()
+        .any(|line| !line.trim().is_empty() && !line.trim().starts_with('#'));
+    if !has_patches {
+        log::debug!(
+            "'{}' contains no patches, skipping quilt patch application",
+            series_path.display()
+        );
+        return Ok(());
+    }
+
+    // Make sure quilt is available in the build context
+    log::debug!("Installing quilt for patch application...");
+    let status = ctx
+        .command("apt-get")
+        .envs(env.clone())
+        .arg("-y")
+        .arg("install")
+        .arg("quilt")
+        .status()?;
+    if !status.success() {
+        return Err("Could not install 'quilt', required to apply patches".into());
+    }
+
+    // Apply all patches listed in the series
+    log::info!("Applying quilt patches from debian/patches/series...");
+    let mut patch_env = env.clone();
+    patch_env.insert("QUILT_PATCHES".to_string(), "debian/patches".to_string());
+    let status = ctx
+        .command("quilt")
+        .current_dir(package_dir)
+        .envs(patch_env)
+        .arg("push")
+        .arg("-a")
+        .status()?;
+    if !status.success() {
+        return Err("Failed to apply quilt patches ('quilt push -a')".into());
+    }
+
+    Ok(())
+}
+
 fn install_injected_packages(
     packages: &[&str],
     env: &HashMap<String, String>,