Fix stale ondrej/php RSA-1024 key warning on alpha; document the gotcha

add-apt-repository --remove silently no-op'd against the existing
non-standard-named .sources file left over from an earlier release
upgrade. Removed the stale source/key manually and re-added the PPA
fresh - now embeds Signed-By inline, no more separate trusted.gpg.d
keyring file. Verified clean apt update, no package churn, dyndns and
sanity-check still pass.

TODO.md

@@ -672,8 +672,8 @@ Nothing here is urgent; all are low-risk, no-downtime changes.
       Root usage barely moved (already 10% with 136G free beforehand) -
       this was dead-weight removal, not a space-pressure fix.
 
-- [ ] **Stale RSA-1024 signing-key warning from the `ondrej/php` PPA** — found 2026-07-26
-      `apt update` on alpha prints: "Signature by key
+- [x] **Stale RSA-1024 signing-key warning from the `ondrej/php` PPA** — found and fixed 2026-07-26
+      `apt update` on alpha printed: "Signature by key
       14AA40EC0831756756D7F66C4F4EA0AAE5267A6C uses weak algorithm
       (rsa1024)" for `ppa:ondrej/php`. Researched before acting rather
       than assuming the PPA itself is compromised or poorly run: this is
@@ -684,14 +684,26 @@ Nothing here is urgent; all are low-risk, no-downtime changes.
       in noble) only just started warning about it everywhere. Launchpad
       finished re-signing every affected PPA with RSA-4096 by August
       2024 (confirmed via Launchpad's own answers/support tracker); the
-      warning persists here only because apt's local keyring still has
+      warning persisted here only because apt's local keyring still had
       the *old* cached key. No evidence of any compromise or malware
       incident tied to this PPA.
-      **Fix, not yet applied**: remove and re-add the PPA
-      (`sudo add-apt-repository --remove ppa:ondrej/php && sudo
-      add-apt-repository ppa:ondrej/php`) to force-fetch the current
-      RSA-4096 key and clear the warning. Purely cosmetic/stale-cache,
-      not an active security exposure, so low priority - but worth doing
-      next time other apt maintenance is being done on alpha. Also
-      update `SETUP.md`'s `ondrej/php` note (currently just says "check
-      the `Suites:` line") to mention this exact warning and fix.
+      Fixed: `add-apt-repository --remove ppa:ondrej/php` didn't
+      actually touch anything - the existing source file was a leftover
+      non-standard name (`ondrej-ubuntu-php-focal.sources`, a naming
+      artifact from an earlier release-upgrade rename) that its removal
+      logic didn't match, and it added/removed an unrelated
+      launchpadcontent.net entry instead. Backed up the old
+      `.sources` file and the old key (`/etc/apt/trusted.gpg.d/
+      ondrej_ubuntu_php.gpg`) to `/root/apt-backup-ondrej-php/`,
+      deleted both manually, then `add-apt-repository ppa:ondrej/php`
+      fresh - created a correctly-named `ondrej-ubuntu-php-noble.sources`
+      pointing at `https://ppa.launchpadcontent.net/ondrej/php/ubuntu/`
+      with the current key embedded inline via `Signed-By:` (modern
+      deb822 style, no more separate `trusted.gpg.d` keyring file at
+      all). Verified: `apt update` clean, no rsa1024 warning; same
+      package version still installed/candidate (no unwanted churn);
+      `dyndns.jayfield.org` still `401`s; `sanity-check.sh` full pass
+      (48/48) immediately after. Noted in passing: Ondřej's own PPA
+      description says this repo "is in process of being merged into
+      https://packages.sury.org/php/" - a future migration to watch for,
+      not an action item yet.