fix(ci): rebuild apt sources with per-arch entries before arm64 cross-compile install

rust:1.88-slim (Debian Bookworm) uses DEB822-format sources which have no arch
restriction. After dpkg --add-architecture arm64, apt tries to resolve deps for
both amd64 and arm64 simultaneously and hits 'held broken packages' conflicts on
shared -dev packages.

Fix: remove debian.sources and write a clean sources.list that pins amd64 repos
to [arch=amd64] and arm64 repos to [arch=arm64]. This gives apt a clear,
non-conflicting view of each architecture's package set.

.gitea/workflows/auto-tag.yml

@@ -398,6 +398,18 @@ jobs:
       - name: Install dependencies
         run: |
           dpkg --add-architecture arm64
+          # Remove DEB822-format sources (debian.sources) if present and replace with
+          # explicit per-arch entries in sources.list. Without this, apt tries to resolve
+          # deps across both amd64 and arm64 simultaneously and hits "held broken packages".
+          rm -f /etc/apt/sources.list.d/debian.sources
+          cat > /etc/apt/sources.list << 'SOURCES'
+deb [arch=amd64] http://deb.debian.org/debian bookworm main
+deb [arch=amd64] http://deb.debian.org/debian bookworm-updates main
+deb [arch=amd64] http://security.debian.org/debian-security bookworm-security main
+deb [arch=arm64] http://deb.debian.org/debian bookworm main
+deb [arch=arm64] http://deb.debian.org/debian bookworm-updates main
+deb [arch=arm64] http://security.debian.org/debian-security bookworm-security main
+SOURCES
           apt-get update -qq
           apt-get install -y -qq \
             gcc-aarch64-linux-gnu g++-aarch64-linux-gnu \