docs/setup/01-dev-debian-vm-setup.md

@@ -162,7 +162,7 @@ What each script does:
 
 | Script                                               | Effect                                                                                                                                                                                                                                                                          | Idempotent? |
 | ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- |
-| [`10-base-packages.sh`](scripts/10-base-packages.sh) | `apt update` + install base packages (curl wget git build-essential ca-certificates gnupg software-properties-common)                                                                                                                                                           | ✅          |
+| [`10-base-packages.sh`](scripts/10-base-packages.sh) | `apt update` + install the minimal set every other script depends on: `curl wget git ca-certificates gnupg build-essential pkg-config`.                                                                                                                                         | ✅          |
 | [`20-zsh.sh`](scripts/20-zsh.sh)                     | Install zsh + Oh My Zsh + Powerlevel10k + plugins (autosuggestions, syntax-highlighting). Patch `~/.zshrc` (theme + plugins + fzf hook) and `~/.bashrc` (exec zsh on interactive shells — `chsh` is blocked on the corp VM).                                                    | ✅          |
 | [`30-cli-tools.sh`](scripts/30-cli-tools.sh)         | Install `bat eza fd-find ripgrep fzf zoxide ncdu keychain` + `jq yq httpie make tree htop tmux direnv dnsutils unzip`. Aliases for the Debian-renamed binaries (`batcat`→`bat`, `fdfind`→`fd`).                                                                                 | ✅          |
 | [`40-node.sh`](scripts/40-node.sh)                   | Install nvm. Install Node from the repo's `.nvmrc` (currently `24`). Enable corepack, pin pnpm to `package.json`'s `packageManager`.                                                                                                                                            | ✅          |

docs/setup/scripts/10-base-packages.sh

@@ -9,9 +9,23 @@ require_not_root
 log "apt update"
 sudo apt-get update -qq
 
+# Minimal set actually consumed by the other scripts:
+#   - curl/wget    used by 40-node.sh (nvm install), 50-docker.sh (gpg key)
+#                  and the .NET appendix (wget packages-microsoft-prod.deb)
+#   - git          every other script that touches the repo
+#   - ca-certs     HTTPS over apt + curl/wget
+#   - gnupg        verifying the Docker apt repo key
+#   - build-essential / pkg-config — native deps during pnpm install
+#
+# Deliberately NOT installed (deprecated or unused on Debian 13 Trixie):
+#   - software-properties-common: drops `add-apt-repository`, which we
+#     don't use (50-docker.sh writes /etc/apt/sources.list.d/docker.list
+#     manually). Also failing to resolve on a fresh Trixie install.
+#   - apt-transport-https: apt has had native HTTPS support since 1.5 (2018),
+#     the transitional package isn't needed and is intermittently absent.
+#   - lsb-release: shell scripts read /etc/os-release directly (see 50-docker.sh).
 apt_install \
-  curl wget git ca-certificates gnupg lsb-release \
+  curl wget git ca-certificates gnupg \
-  software-properties-common apt-transport-https \
   build-essential pkg-config
 
 ok "Base packages ready."