fix(builder): 版本时间精确到分钟，修复同日重构建的 apt 排序

同日同分支的测试版本前缀完全相同，只剩 +g<sha> 可区分；Debian 版本比较把
hex 当普通文本，新构建可能小于旧构建，apt upgrade 因此拿不到最新包。

build_date() → build_stamp()，改为 YYYYMMDDHHMM，时间与日期拼成一段数字
才能按数值比较。不能写成 20260918T1722：Debian 里字母排在标点之前，带 T
的版本小于同日旧格式包的 20260918.…，修复当天仍抢不过已上传的旧包。

补回归测试，用 dpkg --compare-versions 锁定同日重建更大、且压过旧格式同日包。

skills/builder/scripts/version.sh

@@ -11,11 +11,19 @@ With --docker, print the Docker tag rendering of that version.
 
 Derivation (builder contract «版本号»):
   official  HEAD exact-match of vX.Y.Z          → X.Y.Z
-  test      nearest ancestor stable tag vX.Y.Z  → X.Y.(Z+1)~YYYYMMDD.branch.n+gSHA
-  no tag    no stable tag reachable from HEAD   → 0.0.0~YYYYMMDD.branch+gSHA
+  test      nearest ancestor stable tag vX.Y.Z  → X.Y.(Z+1)~YYYYMMDDHHMM.branch.n+gSHA
+  no tag    no stable tag reachable from HEAD   → 0.0.0~YYYYMMDDHHMM.branch+gSHA
 
-YYYYMMDD is the build date. SOURCE_DATE_EPOCH, if set, is that instant in
-UTC; otherwise the local calendar date. Official X.Y.Z never gets a date.
+YYYYMMDDHHMM is the build minute (day plus time of day), with no separator:
+the digits must stay in one run so Debian compares them numerically. A letter
+separator (YYYYMMDDTHHMM) would compare *below* the bare date, because Debian
+orders letters before punctuation — same-day packages built with the old
+date-only scheme would outrank the new ones. SOURCE_DATE_EPOCH, if set, is
+that instant in UTC; otherwise the local date and time. Official X.Y.Z never
+gets a date. Minute precision is required for apt: Debian version comparison
+ignores upload order, so same-day rebuilds that differ only in +gSHA compare
+as arbitrary text (a newer build can sort below an older one). With the minute
+in the version, later builds always compare greater.
 
 Stable tags match v<major>.<minor>.<patch> only. Baseline is ancestry, not
 the highest version in the repository. This script does not fetch tags.
@@ -112,13 +120,17 @@ short_sha() {
   gitc rev-parse HEAD | cut -c1-7
 }
 
-# Build-day YYYYMMDD. SOURCE_DATE_EPOCH (UTC) wins when set, for reproducible
-# test packages; otherwise the machine's current local date.
-build_date() {
+# Build-minute YYYYMMDDHHMM. SOURCE_DATE_EPOCH (UTC) wins when set, for
+# reproducible test packages; otherwise the machine's current local time.
+# The minute is not decoration: it is what keeps same-day rebuilds ordered in
+# Debian version comparison (0.0.0~202609181036… < 0.0.0~202609181722…). It is
+# glued to the date with no 'T' so the whole stamp stays one numeric run;
+# '20260918T1722' would sort below '20260918.dev-…' and lose to old packages.
+build_stamp() {
   if [[ -n "${SOURCE_DATE_EPOCH:-}" ]]; then
-    date -u -d "@${SOURCE_DATE_EPOCH}" +%Y%m%d
+    date -u -d "@${SOURCE_DATE_EPOCH}" +%Y%m%d%H%M
   else
-    date +%Y%m%d
+    date +%Y%m%d%H%M
   fi
 }
 
@@ -157,7 +169,7 @@ nearest_stable_tag() {
 }
 
 derive_canonical() {
-  local tag base n sha branch ymd
+  local tag base n sha branch stamp
   tag=$(official_tag_at_head)
   if [[ -n "$tag" ]]; then
     printf '%s' "${tag#v}"
@@ -165,14 +177,14 @@ derive_canonical() {
   fi
   sha=$(short_sha)
   branch=$(branch_slug)
-  ymd=$(build_date)
+  stamp=$(build_stamp)
   base=$(nearest_stable_tag)
   if [[ -z "$base" ]]; then
-    printf '0.0.0~%s.%s+g%s' "$ymd" "$branch" "$sha"
+    printf '0.0.0~%s.%s+g%s' "$stamp" "$branch" "$sha"
     return
   fi
   n=$(gitc rev-list --count "${base}..HEAD")
-  printf '%s~%s.%s.%s+g%s' "$(bump_patch "$base")" "$ymd" "$branch" "$n" "$sha"
+  printf '%s~%s.%s.%s+g%s' "$(bump_patch "$base")" "$stamp" "$branch" "$n" "$sha"
 }
 
 to_docker() {