Detect aarch64 rebuilds, including against carried dependencies

sync-rebuilds followed PUBLISHED_ARCHES (x86_64 by default), so the scheduled
run skipped every aarch64-only package, and it read aarch64 triggers from Arch
Linux ARM even when this repository carries them. It now follows the
architectures a merge builds (CI_ARCHES, shared with build-matrix), and reads a
carried trigger from its recipe once edge publishes that version; until then
its dependents wait. Published databases are verified before use and loaded
once per run.

helpers/paths.sh

@@ -43,6 +43,20 @@ reference_arch() {
   published_arches | head -1
 }
 
+# Architectures a merge to master builds and publishes: bin/build-matrix plans
+# a PR build for each one a package supports, and publish.yml ships them. This
+# is independent of PUBLISHED_ARCHES, so anything deciding what a merge has to
+# rebuild (bin/sync-rebuilds) follows this list. CI_ARCHES overrides it.
+CI_ARCHES="${CI_ARCHES:-x86_64 aarch64}"
+
+ci_arches() {
+  local arch
+  for arch in $CI_ARCHES; do
+    require_valid_arch "$arch"
+    echo "$arch"
+  done
+}
+
 # Scheduled-pipeline state, one file per channel and architecture, so one
 # architecture's queue or backoff never gates another's.
 STATE_DIR="${OMARCHY_STATE_DIR:-/root/.state}"