fix(xcat-dep): gate publication on the whole manifest, whatever this run built

verify_assembled_repo filtered the manifest through required_pkgs() with this
invocation's --skip-genesis / --skip-xcat-dep. Since the documented publish-only
run IS `--skip-build --skip-genesis --publish`, the flags that describe what this
invocation built were also deciding what the published repository was allowed to
lack -- so a repository with no xcat-genesis-base passed its own publication
gate (PR #63 review).

Those flags mean "this invocation did not build it", never "the repository may
ship without it": a package built by an earlier run is still expected in the
tree, which the side tree is seeded from. The gate now takes the manifest whole.
The other two required_pkgs() call sites are unchanged and correct -- they choose
what to BUILD and what to validate in THIS arch's staging.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>

sbuild-all.pl

@@ -908,7 +908,13 @@ sub verify_assembled_repo {
                 push @all, "[$cn/$a] NO-MANIFEST section [$tgt] in $manifest, but $a is expected";
                 next;
             }
-            my @names = required_pkgs([sort keys %$req], $skip_genesis, $skip_xcat_dep);
+            # The WHOLE manifest, deliberately -- no required_pkgs() skip filtering here. The
+            # --skip-* flags say what this INVOCATION built, and the documented publish-only run
+            # passes --skip-genesis; honouring them here would let the run that publishes decide
+            # what the published repository is allowed to be missing, and a repo with no Genesis
+            # package would pass its own publication gate. Packages this invocation did not build
+            # are still expected in the tree (seeded from the previously published repo).
+            my @names = sort keys %$req;
             my $idx = "$adir/dists/$cn/main/binary-$a/Packages";
             unless (-f $idx) {
                 push @all, "[$cn/$a] MISSING-INDEX (no $idx)";