fix: sweep stale hashed indexes BEFORE fdroid update, not after

scan_repo_files() in fdroidserver picks up any .json file under repo/
whose name isn't in its ignore list. Our renamed index-v2-<hash>.json
from the prior rehash run isn't in that list, so the next fdroid update
indexed it as an installable "package" with packageName == its sha256.

cleanup_stale_indexes in rehash.py already does the right thing — it
just ran too late, after the bogus entry was already in the new index.
Move the same sweep into the entrypoint, before fdroid update runs, so
scan_repo_files() sees a clean directory.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

entrypoint.sh

@@ -9,10 +9,26 @@
 set -eu
 . /etc/profile.d/bsenv.sh
 
+# Pre-update cleanup: sweep hashed index files left by the prior rehash run.
+# Otherwise fdroidserver's scan_repo_files() picks them up as installable
+# items (their .json extension passes is_repo_file(), since the hashed name
+# isn't in its ignore list) and a bogus "index-v2-<hash>" package shows up
+# in the index. We check every arg (not just $1) so global flags before the
+# subcommand (e.g. `-v update`) still trigger this.
+for arg in "$@"; do
+    if [ "$arg" = "update" ]; then
+        for repodir in repo archive; do
+            if [ -d "$repodir" ]; then
+                rm -f "$repodir"/index-v2-*.json "$repodir"/index-v2-*.json.asc
+            fi
+        done
+        break
+    fi
+done
+
 GRADLE_USER_HOME="${home_vagrant}/.gradle" "${fdroidserver}/fdroid" "$@"
 
-# Auto-rehash after a successful update. We check every arg (not just $1)
-# so global flags before the subcommand (e.g. `-v update`) still trigger it.
+# Auto-rehash after a successful update.
 for arg in "$@"; do
     if [ "$arg" = "update" ]; then
         fdroidserver-ipfs-rehash