Integrity fixes: atomic writes, rc checks, curl

- Verified the repository backup rc in migrate.sh. `_persistent_backup_repos()` now aborts before any destructive step when the tar archive is missing or corrupt, removing the invalid backup itself.
- Verified the restore rc in migrate.sh. `_restore_backup()` now reports failure instead of printing a green "Backup restored" message, and its caller distinguishes a restored backup from a failed restore.
- Made the upgrade phases fail honestly. `apt upgrade` and `apt full-upgrade` now abort with `apt --fix-broken install` + `dpkg --configure -a` instructions instead of reporting "completed successfully" over a partially-upgraded system.
- Made repository source writes atomic. Both writers tee into a `.tmp` file and move into place, and the `/etc/apt/sources.list` removal now happens after the write.
- Corrected the SID warning text in migrate.sh to reflect that security fixes arrive via package uploads rather than a nonexistent sid-security suite.
- Added exit-path cleanup traps for the temp `.deb` files: `trap 'rm -f "$deb_path"' RETURN` in `heroic.sh`and `tools.sh`.
- Tightened Heroic download handling: the API fetch uses `curl -fsS --connect-timeout 10 --max-time 30`, the download uses `curl -fsSL --max-time 300`, and the `.deb` is validated with both `dpkg-deb --info` and `dpkg-deb --contents`; `sudo apt install` is guarded with `if !` before the temporary file is deleted.
- Tightened the OpenRGB install path: the Codeberg API fetch uses `curl -fsS --connect-timeout 10 --max-time 30` and the download `curl -fsSL --max-time 300`, with the same dual `dpkg-deb` integrity check as the Heroic fallback.
- Guarded the OpenRGB post-install side effects: the script now aborts after removing the failed `.deb` if `sudo apt install` returns non-zero, so `modprobe i2c-dev`, `/etc/modules`, the `i2c` group membership, `udevadm`, and the `setcap` step no longer run when the package is absent.

tests/repo_detect.bats

@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+# repo_detect.bats — Offline tests for modules/repos/repo_detect.sh
+# and is_backports_enabled() from modules/utils.sh.
+#
+# No `set -euo pipefail` here: BATS controls error handling
+# per test.
+#
+# The modules under test read ${APT_DIR:-/etc/apt} (the APT_DIR
+# indirection added for testability).  mock_reset() points APT_DIR
+# at a fresh empty $MOCK_APT_ROOT per test, and every test builds
+# its own fixture tree inside it — the real /etc/apt is never
+# read, so the suite is 100% offline and hermetic.
+#
+# Every function under test answers via stdout (echo
+# true/false/deb822/...), so `run` + `$output` is the natural
+# assertion style.
+
+load test_helper.bash
+
+setup() {
+    mock_reset
+    load_utils
+}
+
+teardown() {
+    if [ -n "${MOCK_SUDO_LOG:-}" ]; then
+        rm -f "$MOCK_SUDO_LOG"
+    fi
+    if [ -n "${MOCK_APT_ROOT:-}" ]; then
+        rm -rf "$MOCK_APT_ROOT"
+    fi
+}
+
+# ── Fixture helper ───────────────────────────────────
+# Write one fixture file inside the mock apt root, with one
+# content line per argument:
+#   _fixt_file sources.list "deb ... bookworm main" ...
+#   _fixt_file sources.list.d/debian.sources "Types: deb" ...
+_fixt_file() {
+    local rel="$1"
+    shift
+    mkdir -p "${MOCK_APT_ROOT}/$(dirname "$rel")"
+    printf '%s\n' "$@" >"${MOCK_APT_ROOT}/${rel}"
+}
+
+# ── is_backports_enabled (modules/utils.sh) ──────────
+@test "is_backports_enabled returns true with backports in sources.list" {
+    _fixt_file sources.list \
+        "deb http://deb.debian.org/debian bookworm main" \
+        "deb http://deb.debian.org/debian bookworm-updates main" \
+        "deb http://deb.debian.org/debian bookworm-backports main"
+    run is_backports_enabled
+    [ "$status" -eq 0 ]
+    [ "$output" = "true" ]
+}
+
+@test "is_backports_enabled returns false without backports" {
+    _fixt_file sources.list \
+        "deb http://deb.debian.org/debian bookworm main" \
+        "deb http://deb.debian.org/debian bookworm-updates main"
+    run is_backports_enabled
+    [ "$status" -eq 0 ]
+    [ "$output" = "false" ]
+}
+
+@test "is_backports_enabled returns true with a standalone backports .list file" {
+    _fixt_file sources.list.d/debian-backports.list \
+        "deb http://deb.debian.org/debian bookworm-backports main"
+    run is_backports_enabled
+    [ "$status" -eq 0 ]
+    [ "$output" = "true" ]
+}
+
+@test "is_backports_enabled returns true with a deb822 backports suite" {
+    _fixt_file sources.list.d/debian-backports.sources \
+        "Types: deb" \
+        "URIs: http://deb.debian.org/debian" \
+        "Suites: bookworm-backports" \
+        "Components: main" \
+        "Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg"
+    run is_backports_enabled
+    [ "$status" -eq 0 ]
+    [ "$output" = "true" ]
+}
+
+# ── detect_repo_format ───────────────────────────────
+@test "detect_repo_format returns deb822 for a debian.sources file" {
+    # DEB822 is only valid on Debian 13 (Trixie).
+    DEBIAN_VERSION="13"
+    _fixt_file sources.list.d/debian.sources \
+        "Types: deb" \
+        "URIs: http://deb.debian.org/debian" \
+        "Suites: bookworm bookworm-updates" \
+        "Components: main contrib non-free non-free-firmware" \
+        "Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg"
+    run detect_repo_format
+    [ "$status" -eq 0 ]
+    [ "$output" = "deb822" ]
+}
+
+@test "detect_repo_format returns classic for a classic sources.list" {
+    _fixt_file sources.list \
+        "deb http://deb.debian.org/debian bookworm main" \
+        "deb http://deb.debian.org/debian bookworm-updates main"
+    run detect_repo_format
+    [ "$status" -eq 0 ]
+    [ "$output" = "classic" ]
+}
+
+@test "detect_repo_format returns none for an empty apt root" {
+    run detect_repo_format
+    [ "$status" -eq 0 ]
+    [ "$output" = "none" ]
+}