fix(packaging): an upgrade must not stop and disable the agent — 0.1.9

dpkg calls the OLD package's prerm on an UPGRADE as well as on a removal (rpm passes a
remaining-instance count), and preremove.sh ran `systemctl disable --now monky-deployd.timer`
unconditionally. Upgrading env-dev-01 and env-dev-08 to 0.1.8 today stopped and disabled both
agents.

The failure is silent, which is the dangerous part: the box stays reachable, the containers keep
running, and nothing reports that check-ins have ceased — the backend just stops converging. A
fleet upgrade would have taken every agent offline at once and looked like a success.

preremove.sh now returns early for every upgrade shape (upgrade, failed-upgrade, deconfigure,
rpm's 1) and only disables on a real removal. postinstall.sh try-restarts the long-lived proxy
unit so it picks up the new code; the timer needs nothing, since each tick is a fresh process.

Tests drive the script with a fake systemctl on PATH and assert an upgrade touches no units.
OPERATIONS.md warns that a box coming FROM 0.1.8 or earlier still needs its timer re-enabled by
hand, because the old prerm has already run by then.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1

tests/test_packaging_scripts.py

@@ -0,0 +1,46 @@
+"""The maintainer scripts must not stop the agent on an upgrade.
+
+dpkg calls the OLD package's prerm on an upgrade as well as on a removal, and rpm calls it with
+an install count. `systemctl disable --now` there stopped the agent on every upgrade and left it
+disabled — silently, because the box stays reachable and nothing else notices that check-ins have
+ceased (env-dev-01 and env-dev-08, 2026-09-09).
+"""
+
+from __future__ import annotations
+
+import shutil
+import subprocess
+from pathlib import Path
+
+import pytest
+
+PREREMOVE = Path(__file__).resolve().parents[1] / "packaging" / "scripts" / "preremove.sh"
+
+
+def _run(arg: str, tmp_path: Path) -> list[str]:
+    """Run preremove with a fake `systemctl` on PATH and report the calls it made."""
+    calls = tmp_path / "systemctl.log"
+    fake = tmp_path / "bin"
+    fake.mkdir(exist_ok=True)
+    (fake / "systemctl").write_text(f'#!/bin/sh\necho "$@" >> {calls}\nexit 0\n')
+    (fake / "systemctl").chmod(0o755)
+    env = {"PATH": f"{fake}:/usr/bin:/bin"}
+    r = subprocess.run(["sh", str(PREREMOVE), arg], env=env, capture_output=True, text=True)
+    assert r.returncode == 0, r.stderr
+    return calls.read_text().splitlines() if calls.exists() else []
+
+
+@pytest.mark.skipif(not Path("/run/systemd/system").is_dir(), reason="needs a systemd host to reach the disable branch")
+@pytest.mark.parametrize("arg", ["remove", "0"])
+def test_a_real_removal_disables_the_units(arg, tmp_path):
+    assert any("disable" in c for c in _run(arg, tmp_path))
+
+
+@pytest.mark.parametrize("arg", ["upgrade", "failed-upgrade", "deconfigure", "1"])
+def test_an_upgrade_leaves_the_units_alone(arg, tmp_path):
+    assert _run(arg, tmp_path) == []
+
+
+def test_the_script_is_shell_clean():
+    assert shutil.which("sh")
+    subprocess.run(["sh", "-n", str(PREREMOVE)], check=True)