Deploy workflow silently dropped the krill-mcp-token packaging step

Issue: none — reported directly by Ben (sudo krill-mcp-token → command not found on prod) Root cause category: Build/CI — workflow diverged from DEPLOYMENT.md by deleting a failing step Module: build-ci

What happened

krill-oss/krill-mcp/DEPLOYMENT.md specifies chmod 755 krill-mcp-service/package/usr/local/bin/krill-mcp-token in the deb build, but Deploy Debian Repo.yml omitted that line. The script itself was never committed to krill-oss (its bin/ gitignore pattern swallowed it), so the chmod would have failed — and dropping the line let the build go green while shipping a deb whose postinst banner and docs advertise a command that doesn’t exist. Companion fix in krill-oss adds the actual script and un-ignores its path.

Fix

• .github/workflows/Deploy Debian Repo.yml: restored the chmod 755 krill-mcp-service/package/usr/local/bin/krill-mcp-token line in the “Build krill-mcp deb package” step, matching DEPLOYMENT.md.
• krill-oss (separate change): added the krill-mcp-token script, gitignore carve-out, and the same chmod in Verify Agent Ghost.yml. See krill-oss/docs/lessons/2026-06-12-krill-mcp-token-never-shipped.md.

Prevention

• Keep workflow YAML and its DEPLOYMENT.md snippet in lockstep. When a documented build step fails, fix the underlying cause (here: a never-committed file) instead of deleting the step — deleting converts a loud failure into a silently broken artifact.
• After packaging changes, diff dpkg-deb --contents against every command the postinst banner and docs mention. Anything advertised to the user must appear in the deb’s file list.