Pin Terra through repos.override.d so terra-release updates stop undoing it

setup/provenance/README.md

@@ -159,8 +159,12 @@ installed. Its effective `terra` configuration reported `gpgcheck = 1`,
 `pkg_gpgcheck = 1`, and `repo_gpgcheck = 1`; no GPG-bypass option was used.
 The package's own `/etc/yum.repos.d/terra.repo` uses its Terra metalink and
 `RPM-GPG-KEY-terra44`. That differs from Panama's deliberately staged local
-key/base-URL file in `install-packages`, which replaces the release-generated
-file only after this verified bootstrap step.
+key and base URL. `install-packages` applies those after this verified
+bootstrap step as `/etc/dnf/repos.override.d/80-panama-terra.repo`, which dnf
+lays over the package's file. The pin does not edit `terra.repo` itself,
+because terra-release replaces that file on every update. Release 44-11 did
+so on 2026-10-28, shipping `repo_gpgcheck=0`, and every Panama machine
+stopped installing packages until the pin moved to the override directory.
 
 Although the command runner returned after 30 seconds while DNF was still
 loading metadata, Podman's retained event log records the exact command's