Auto-derive per-commit Debian Version for dev builds

Inject git date + short SHA into the Debian Version field when
Cargo.toml's crate version ends in -dev, so apt-based upgrade
detection works without operator workarounds. Form:
  <base>~dev+git<YYYYMMDD>.<sha>[.dirty]-1
e.g. 0.3.0~dev+git20260429.6def31b-1.

Each commit produces a uniquely-comparable Version, so
`apt install ./*.deb` and `ansible.builtin.apt: deb:` stop
silently no-op'ing when one dev .deb is installed on top of
another. The ~dev marker sorts pre-tagged-release so 0.3.0
supersedes any prior dev .deb. Tagged builds (Cargo.toml without
-dev) keep the clean <version>-1 form. --version override still
wins.

Note: legacy 0.3.0-dev-1 dev installs sort ABOVE the new form;
hosts upgrading from a legacy install will need `dpkg -i` once
on the next dev .deb to bypass apt's downgrade refusal.

CHANGELOG.md

@@ -138,6 +138,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   (development) packages with sysusers.d/tmpfiles.d integration
   ([#21](https://github.com/jmcorgan/fips/pull/21),
   [@dskvr](https://github.com/dskvr))
+- `packaging/debian/build-deb.sh` now auto-derives a per-commit Debian
+  Version field for dev builds (Cargo.toml version ending in `-dev`)
+  using the form `<base>~dev+git<YYYYMMDD>.<sha>[.dirty]-1`, e.g.
+  `0.3.0~dev+git20260429.6def31b-1`. Each commit produces a uniquely-
+  comparable Version string so `apt install ./*.deb` and
+  `ansible.builtin.apt: deb:` no longer silently no-op when one dev
+  build is installed on top of another. The `~dev` marker sorts
+  pre-`0.3.0` so a tagged release supersedes any prior dev .deb.
+  Tagged release builds (no `-dev` in Cargo.toml) keep the clean
+  `<version>-1` form. Operator override via `--version` still wins
 
 ### Changed
 

packaging/debian/build-deb.sh

@@ -66,6 +66,30 @@ if [ -z "${SOURCE_DATE_EPOCH:-}" ]; then
     export SOURCE_DATE_EPOCH=$(git log -1 --format=%ct)
 fi
 
+# Auto-derive a per-commit Debian Version for dev builds so apt-based
+# upgrade detection (`ansible.builtin.apt: deb:`, `apt install ./*.deb`)
+# does not silently no-op when one dev .deb is installed on top of another.
+# Tagged release builds (Cargo.toml version without "-dev") keep the
+# clean upstream version. Operator override via --version still wins.
+if [[ -z "${VERSION_OVERRIDE}" ]]; then
+    CRATE_VERSION=$(awk -F'"' '/^version = /{print $2; exit}' Cargo.toml)
+    if [[ "${CRATE_VERSION}" == *-dev ]]; then
+        BASE_VERSION="${CRATE_VERSION%-dev}"
+        GIT_DATE=$(git log -1 --format=%cs | tr -d '-')
+        GIT_SHA=$(git rev-parse --short HEAD)
+        DIRTY_SUFFIX=""
+        if [[ -n "$(git status --porcelain 2>/dev/null)" ]]; then
+            DIRTY_SUFFIX=".dirty"
+        fi
+        # Debian Version: <upstream>~dev+git<YYYYMMDD>.<sha>[.dirty]-1
+        # The "~" makes every dev build sort BEFORE the eventual tagged
+        # release; the date+sha makes consecutive dev builds compare as
+        # different versions; the trailing "-1" is the Debian revision.
+        VERSION_OVERRIDE="${BASE_VERSION}~dev+git${GIT_DATE}.${GIT_SHA}${DIRTY_SUFFIX}-1"
+        echo "Auto-derived dev Version: ${VERSION_OVERRIDE}"
+    fi
+fi
+
 # Build the .deb package
 echo "Building .deb package..."
 OUTPUT_DIR="$(mktemp -d)"