Cloud Worker: Minimum version constraint

I enabled cloud workers and gave debusine.debian.net enough load to spin some up. It spun up 2 batches (of 2 and 3), and all 5 instances ended up with the trixie version of debusine-worker, due to:

Cloud-init v. 25.1.4 running 'modules:final' at Mon, 19 Jan 2026 19:32:46 +0000. Up 58.36 seconds.
Get:1 file:/etc/apt/mirrors/debian.list Mirrorlist [38 B]
Get:2 file:/etc/apt/mirrors/debian-security.list Mirrorlist [47 B]
Hit:3 https://cdn-aws.deb.debian.org/debian trixie InRelease
Hit:4 https://cdn-aws.deb.debian.org/debian trixie-updates InRelease
Get:7 https://freexian-team.pages.debian.net/debusine/repository trixie InRelease [5471 B]
Hit:5 https://cdn-aws.deb.debian.org/debian trixie-backports InRelease
Hit:6 https://cdn-aws.deb.debian.org/debian-security trixie-security InRelease
Get:8 https://freexian-team.pages.debian.net/debusine/repository trixie/main all Packages [3442 B]
Err:8 https://freexian-team.pages.debian.net/debusine/repository trixie/main all Packages
  File has unexpected size (3453 != 3442). Mirror sync in progress? [IP: 2a04:4e42:200::644 443]
  Hashes of expected file:
   - Filesize:3442 [weak]
   - SHA512:378af8fd7f0bb55509aede6ce0ff01394803174964ae6ad240d63a7d1067a1be0678dea0b1105dce4f947e897e53
c244df972681f5151732c5cc0e3e22886196
   - SHA256:da1ae0ff9c8e1926572b51bc0b4a2633002d5c2344f6f97ee48014a139e76aae
   - SHA1:b07086aac4f4903cd3073f79dd962b1dbbd404ad [weak]
   - MD5Sum:fe543610e929b67109d84438f5b06aa8 [weak]
  Release file created at: Mon, 19 Jan 2026 16:34:03 +0000
Fetched 5471 B in 0s (13.0 kB/s)
Reading package lists...
E: Failed to fetch https://freexian-team.pages.debian.net/debusine/repository/dists/trixie/main/binary-a
ll/Packages.bz2  File has unexpected size (3453 != 3442). Mirror sync in progress? [IP: 2a04:4e42:200::6
44 443]
   Hashes of expected file:
    - Filesize:3442 [weak]
    - SHA512:378af8fd7f0bb55509aede6ce0ff01394803174964ae6ad240d63a7d1067a1be0678dea0b1105dce4f947e897e5
3c244df972681f5151732c5cc0e3e22886196
    - SHA256:da1ae0ff9c8e1926572b51bc0b4a2633002d5c2344f6f97ee48014a139e76aae
    - SHA1:b07086aac4f4903cd3073f79dd962b1dbbd404ad [weak]
    - MD5Sum:fe543610e929b67109d84438f5b06aa8 [weak]
   Release file created at: Mon, 19 Jan 2026 16:34:03 +0000
E: Some index files failed to download. They have been ignored, or old ones used instead.
2026-01-19 19:32:47,794 - distros[ERROR]: Failed to update package using apt: Unexpected error while run
ning command.
Command: ['eatmydata', 'apt-get', '--option=Dpkg::Options::=--force-confold', '--option=Dpkg::options::=
--force-unsafe-io', '--assume-yes', '--quiet', 'update']
Exit code: 100
`

These workers are failure machines. Every task has input that they can't understand so they reject everything with an error.

I can think of a few things we can do:

1. Set up appropriate pins to ensure src:debusine comes from the correct source.
2. Explicitly set a minimum acceptable version, somewhere. Maybe a default setting that we bump when we know we've made backwards-incompatible changes in workers? We could even have a method that returns >= current server version. Have the worker declare its version to the server, and give the server a chance to reject it.

For pinning:

# apt-cache policy
Package files:
 100 /var/lib/dpkg/status
     release a=now
 500 https://freexian-team.pages.debian.net/debusine/repository trixie/main all Packages
     release o=. trixie,a=trixie,n=trixie,l=. trixie,c=main,b=all
     origin freexian-team.pages.debian.net
 500 mirror+file:/etc/apt/mirrors/debian-security.list trixie-security/main amd64 Packages
     release v=13,o=Debian,a=stable-security,n=trixie-security,l=Debian-Security,c=main,b=amd64
 100 mirror+file:/etc/apt/mirrors/debian.list trixie-backports/main amd64 Packages
     release o=Debian Backports,a=stable-backports,n=trixie-backports,l=Debian Backports,c=main,b=amd64
 500 mirror+file:/etc/apt/mirrors/debian.list trixie-updates/main amd64 Packages
     release v=13-updates,o=Debian,a=stable-updates,n=trixie-updates,l=Debian,c=main,b=amd64
 500 mirror+file:/etc/apt/mirrors/debian.list trixie/main amd64 Packages
     release v=13.3,o=Debian,a=stable,n=trixie,l=Debian,c=main,b=amd64