scripts/upgrade-irv-ml1-cuda: detect existing cuda repo, clean up orphan

Phase 1 was unconditionally adding /etc/apt/sources.list.d/nvidia-cuda.list
pointing at /etc/apt/keyrings/nvidia-cuda.gpg. But irv-ml1 already had
the upstream-style /etc/apt/sources.list.d/cuda-debian12-x86_64.list
with /usr/share/keyrings/cuda-archive-keyring.gpg — that's how the
existing 570 driver got installed in the first place. APT then refused
both: 'Conflicting values set for option Signed-By regarding source ...
debian12/x86_64/'.

Now the script:
  * removes any orphan nvidia-cuda.{list,gpg} files from a previous
    failed run
  * greps existing /etc/apt/sources.list.d/*.list for a debian12 cuda
    repo entry; if found, trusts and uses it
  * only writes a new repo entry if no existing one is found, and
    when it does, uses the same upstream paths (cuda-archive-keyring.gpg,
    cuda-debian12-x86_64.list) so reruns are stable

Re-run safe — phase1 can be invoked any number of times without
accumulating conflicting configs.

scripts/upgrade-irv-ml1-cuda.sh

@@ -60,15 +60,30 @@ remote_phase1() {
     sudo -v
 
     echo
-    echo "=== adding NVIDIA CUDA APT repo for Debian 12 ==="
+    echo "=== ensuring NVIDIA CUDA APT repo for Debian 12 is configured ==="
-    sudo install -d -m 0755 /etc/apt/keyrings
+    # Clean up any orphan file from a prior failed run (script used to
-    if [ ! -f /etc/apt/keyrings/nvidia-cuda.gpg ]; then
+    # add /etc/apt/sources.list.d/nvidia-cuda.list with its own keyring,
+    # which collided with the upstream-provided cuda-debian12-x86_64.list
+    # using cuda-archive-keyring.gpg; APT refused both with
+    # 'Conflicting values set for option Signed-By').
+    if [ -f /etc/apt/sources.list.d/nvidia-cuda.list ]; then
+        echo "  removing orphan /etc/apt/sources.list.d/nvidia-cuda.list"
+        sudo rm -f /etc/apt/sources.list.d/nvidia-cuda.list /etc/apt/keyrings/nvidia-cuda.gpg
+    fi
+    # Detect an existing cuda repo entry pointing at developer.download.nvidia.com.
+    # If found, trust it (it's how driver 570 got installed in the first place).
+    if grep -RlsE 'developer\.download\.nvidia\.com/compute/cuda/repos/debian12' /etc/apt/sources.list.d/ \
+        >/dev/null; then
+        echo "  cuda repo already configured — skipping add"
+    else
+        echo "  no cuda repo found — adding upstream-style entry"
+        sudo install -d -m 0755 /usr/share/keyrings
         sudo apt-get install -y curl gpg
         curl -fsSL https://developer.download.nvidia.com/compute/cuda/repos/debian12/x86_64/3bf863cc.pub \
-            | sudo gpg --dearmor --yes -o /etc/apt/keyrings/nvidia-cuda.gpg
+            | sudo gpg --dearmor --yes -o /usr/share/keyrings/cuda-archive-keyring.gpg
+        echo "deb [signed-by=/usr/share/keyrings/cuda-archive-keyring.gpg] https://developer.download.nvidia.com/compute/cuda/repos/debian12/x86_64/ /" \
+            | sudo tee /etc/apt/sources.list.d/cuda-debian12-x86_64.list >/dev/null
     fi
-    echo "deb [signed-by=/etc/apt/keyrings/nvidia-cuda.gpg] https://developer.download.nvidia.com/compute/cuda/repos/debian12/x86_64/ /" \
-        | sudo tee /etc/apt/sources.list.d/nvidia-cuda.list >/dev/null
 
     sudo apt-get update -qq