## Summary - Add `--allow-downgrades` to `apt-get -y upgrade` in the overlay step when Pro/FIPS sources are detected - Fixes FIPS rock builds failing because the `fips-updates` repository pins `libgcrypt20` to a version older than the noble GA archive, causing apt to refuse the downgrade without `--allow-downgrades` ## Problem When building FIPS rocks on noble, the `esm.ubuntu.com/fips-updates` repository pins `libgcrypt20` to the FIPS-certified version which is older than the GA version in the standard noble archive. During the overlay `apt-get -y upgrade` step, apt detects this as a downgrade and aborts with: ``` E: Packages were downgraded and -y was used without --allow-downgrades. ``` This started affecting builds recently (e.g. https://github.com/canonical/cilium-rocks/actions/runs/28017207023/job/83118786893). ## Fix The `--allow-downgrades` flag is safe here because: 1. This code path only executes when Pro/FIPS sources are present (guarded by the `find` check for `ubuntu-esm-*.sources` or `ubuntu-fips-*.sources`) 2. The downgrade is intentional - the FIPS pin sets the preferred version and apt should honor it 3. No other packages are affected since only pinned packages will be downgraded It is also future safe because it does not break existing build pipelines and allows the rockcraft team to fix future occurances of the issue when on their own pace.