Format APT maintenance instructions

tools/README-APT.md

@@ -1,10 +1,10 @@
 # Signed distribution repositories
 
 The canonical source is the existing GERANAS Gitea repository
-\`gerardo/framebridge\`. Build all three reviewed DEBs from its release commit;
+`gerardo/framebridge`. Build all three reviewed DEBs from its release commit;
 do not edit installed files to produce an update.
 
-One HTTPS repository at \`https://framebridge.betancourt.one/debian/\` contains
+One HTTPS repository at `https://framebridge.betancourt.one/debian/` contains
 three independent suites:
 
 | Suite | Tested distribution profile |
@@ -14,12 +14,12 @@ three independent suites:
 | mint22 | Linux Mint 22.x, amd64, Python 3.12 |
 
 Select exactly the suite matching the computer. These are three builds of one
-binary package, \`framebridge-original-expanded\`, with unique pool filenames.
+binary package, `framebridge-original-expanded`, with unique pool filenames.
 This table does not certify untested releases or architectures.
 
 ## Prepare and review
 
-Run \`python3 tools/build_apt_repository.py prepare --help\` in the source
+Run `python3 tools/build_apt_repository.py prepare --help` in the source
 repository. Supply the exact three version-matched DEBs, the existing official
 public key and a new output directory. The command copies the artifacts, builds
 indexes and by-hash paths, and prints the immutable input manifest SHA-256.
@@ -27,23 +27,23 @@ It does not open a private keyring, sign, publish or install anything.
 
 Review the manifest, package hashes and release identity before signing.
 The public key must contain exactly one primary release key with fingerprint
-\`2B1F01BC806C0B33CB6CEDDE52859CEBC91B8808\`. Official subkeys are allowed.
+`2B1F01BC806C0B33CB6CEDDE52859CEBC91B8808`. Official subkeys are allowed.
 
 ## Sign in the owner's normal terminal
 
-Run \`python3 tools/build_apt_repository.py sign --help\`. Pass the reviewed
+Run `python3 tools/build_apt_repository.py sign --help`. Pass the reviewed
 output directory and exact manifest SHA-256. The signer requires a non-root
 interactive terminal and an owner-private existing signing home. Set
-\`GPG_TTY=$(tty)\` in that normal terminal if the pinentry implementation needs it.
+`GPG_TTY=$(tty)` in that normal terminal if the pinentry implementation needs it.
 The owner's passphrase is entered only into normal pinentry; it is never an
 argument, environment variable or chat message.
 
-The signer writes \`Release.gpg\` and \`InRelease\` for each suite, verifies the
+The signer writes `Release.gpg` and `InRelease` for each suite, verifies the
 signatures against the public key and exact reviewed Release plaintext, then
 clears the dedicated signing agent. Existing signatures or partial results
 cause refusal; inspect a partial transaction instead of blindly rerunning it.
 
-Run \`verify\` with the same pinned manifest hash after signing and again after
+Run `verify` with the same pinned manifest hash after signing and again after
 transport. Metadata expires after 30 days; publish a freshly signed Release
 before expiry, without altering historical signed artifacts.
 
@@ -55,7 +55,7 @@ current public generation before activation. Preserve the existing signed
 0.3.1 downloads and old repository metadata in an archive path.
 
 Publish only reviewed manifest files, the six verified signature files and the
-signing receipt. Public directories must be \`0755\` and files \`0644\`; a private
+signing receipt. Public directories must be `0755` and files `0644`; a private
 staging umask must not leak into the served generation. Never publish the
 signing home, private receipts, account configuration or operational worktree.
 Activate a complete verified generation, preserving the web unit's existing
@@ -65,26 +65,26 @@ for all three suites through the final HTTPS authority.
 ## Configure a client
 
 Install the verified official public key as
-\`/etc/apt/keyrings/framebridge-archive-keyring.asc\` with mode \`0644\`.
+`/etc/apt/keyrings/framebridge-archive-keyring.asc` with mode `0644`.
 Its fingerprint must match the value above. Add a Deb822 source file:
 
-\`\`\`text
+```text
 Types: deb
 URIs: https://framebridge.betancourt.one/debian/
 Suites: trixie
 Components: main
 Architectures: amd64
 Signed-By: /etc/apt/keyrings/framebridge-archive-keyring.asc
-\`\`\`
+```
 
-Replace \`trixie\` with \`noble\` or \`mint22\` for those tested profiles. Then use
+Replace `trixie` with `noble` or `mint22` for those tested profiles. Then use
 normal APT commands:
 
-\`\`\`sh
+```sh
 sudo apt update
 apt-cache policy framebridge-original-expanded
 sudo apt install --only-upgrade framebridge-original-expanded
-\`\`\`
+```
 
 Do not use trusted=yes or disable signature/validity checks. APT update/download
 verification does not itself prove runtime restart or reboot persistence.
@@ -92,7 +92,7 @@ Confirm the actual installed version and ready connection after each upgrade.
 
 ## Tool checks
 
-\`python3 tools/test_build_apt_repository.py\` creates disposable packages and a
+`python3 tools/test_build_apt_repository.py` creates disposable packages and a
 disposable signing identity in a temporary directory. It tests actual isolated
 APT acceptance for each suite and rejects altered packages/indexes/signatures,
 unexpected versions, path traversal and bundled extra primary trust keys.