docs: install from the signed apt repository

README.md

@@ -20,6 +20,30 @@ Published archives support Linux x86_64 and macOS arm64/x86_64; **Linux arm64
 has no published archive**. Source builds, pinned versions, removal and the
 Homebrew alternative are in the [installation reference](https://intigraph.github.io/tambo/installation-reference.html).
 
+**Debian and Ubuntu (amd64):** install from the signed apt repository, which
+republishes each checksum-verified release. The package puts `tambo` and the
+compatibility `caboodle` command in `/usr/bin`. Check the signing key's
+fingerprint before trusting it; the commands stop if it does not match:
+
+```bash
+curl -fsSL https://scbrown.github.io/apt/key.gpg -o scbrown-stack.gpg \
+  && gpg --show-keys --with-colons scbrown-stack.gpg \
+  | grep -qx 'fpr:::::::::AB5625C5612F643BF76464DF0DC99924994EC959:' \
+  && sudo install -D -m 0644 scbrown-stack.gpg /etc/apt/keyrings/scbrown-stack.gpg \
+  && echo "deb [signed-by=/etc/apt/keyrings/scbrown-stack.gpg] https://scbrown.github.io/apt stable main" \
+     | sudo tee /etc/apt/sources.list.d/scbrown-stack.list \
+  && sudo apt update && sudo apt install tambo
+```
+
+`apt upgrade` then picks up new releases. unattended-upgrades only installs
+from origins it allows, so to have it upgrade tambo too, add
+`"origin=scbrown,codename=stable";` to `Unattended-Upgrade::Origins-Pattern`.
+A host with the older `caboodle 0.3.4` package moves over with
+`sudo apt install tambo` (or `apt full-upgrade`): `caboodle 0.3.4-1` is a
+transitional package that depends on `tambo`.
+Channels, pinning and rollback:
+[scbrown/apt](https://github.com/scbrown/apt#channels-and-pinning).
+
 ## First success: local, single-user
 
 Run in an empty directory you intend to keep:

docs/knowledge/repository-knowledge.json

@@ -8,7 +8,7 @@
       "source": "README.md",
       "subject": "http://aegis.gastown.local/ontology/doc/tambo/README.md",
       "summary": "Tambo installs and verifies the knowledge-tool stack from a reviewable plan. The transition retains the caboodle command and existing plan/state paths; publication and installed verification remain separate.",
-      "source_sha256": "f990353237f5e1a9c895a72bfe3fef0957f73d9db70fd0761d6f09b123518b93",
+      "source_sha256": "ca22562a35bf26d17fd4e9d9ce34d8309768898bf8d714775fe79df713a31264",
       "type": "Concept"
     },
     {
@@ -72,7 +72,7 @@
       "source": "README.md",
       "subject": "http://aegis.gastown.local/ontology/doc/tambo/README.md",
       "summary": "Start with the local single-user quickstart and its verified-tool success checks before selecting remote service mode.",
-      "source_sha256": "f990353237f5e1a9c895a72bfe3fef0957f73d9db70fd0761d6f09b123518b93",
+      "source_sha256": "ca22562a35bf26d17fd4e9d9ce34d8309768898bf8d714775fe79df713a31264",
       "properties": {
         "startHereOrder": 1,
         "glossaryTerm": "https://scbrown.github.io/quechua/ns#Tool"