Document the serialised-writer invariant behind the repodata fingerprint

docs/rpm/remote-github.md

@@ -92,4 +92,6 @@ Repodata is regenerated from the metadata rows on every request by default. Set
 `cache_repodata = true` on the remote to keep the generated `repomd.xml` and its
 `primary`/`filelists`/`other` files in memory per replica. Each request checks a
 cheap row fingerprint (count + newest id) in the database and rebuilds only when
-it moved, so every replica picks up a scan's changes on its next request.
+it moved, so every replica picks up a scan's changes on its next request. The
+fingerprint relies on only one scan writing a remote's rows at a time, which the
+sync lease guarantees across replicas.

internal/database/rpm_metadata.go

@@ -42,6 +42,7 @@ func (db *DB) DeleteRPMMetadata(ctx context.Context, repoName, filePath string)
 
 // RPMMetadataFingerprint is a cheap change detector for a repo's rows: they are
 // only ever inserted or deleted, so (count, max id) moves whenever they change.
+// Sound only while a remote's writers are serialised (github_rpm sync lease), so ids commit in order.
 func (db *DB) RPMMetadataFingerprint(ctx context.Context, repoName string) (count, maxID int64, err error) {
 	err = db.Pool.QueryRow(ctx, `SELECT count(*), coalesce(max(id), 0) FROM rpm_metadata WHERE repo_name = $1`, repoName).Scan(&count, &maxID)
 	return count, maxID, err