Add Debian packages and signed apt distribution

[ctfbruce]

Debuglet currently ships tar archives. This adds an Ubuntu 24.04 amd64 apt installation path using the same verified full payload and a signed repository publication workflow for approved releases.

The debuglet package selects an immutable, separately retained payload. Installing an update leaves managed executors on their recorded version until explicit drain, backup, verified replacement and resume. Removal guards protect referenced payloads and operator state; same-version reinstall repairs damaged or interrupted installations. Release signatures and provenance cover the Debian files and bind their contents to the original build. Repository publication retains earlier packages and consumes complete signed GitHub releases.

The console compatibility pin selects dashboard !17's installation and update instructions. Executors now report the running binary's version after replacement instead of the version saved during enrollment. A pre-existing TCP reset test race found by CI is fixed by waiting for a guest marker before resetting; its strict error assertion and TLS connect-reset case remain intact.

Validation:

• Assembly, release inventory/retention and repository checks passed, including real apt rejection of incorrect trust, altered metadata and altered packages; install, repair, interrupted unpack recovery and state-preserving removal passed.
• On an owned Ubuntu 24.04 systemd host, genuine main1ec packages upgraded through6afd to c057 via a signed HTTPS repository. Two managed executors retained identity, keys, configuration, state and output; old processes remained running through apt staging, and explicit replacement selected the new binaries. Reported versions matched actual processes.
• All seven commands captured from the rendered console update panel succeeded. A subsequent browser-submitted two-executor HTTP group returned two successful200 results with complete output.
• Final8ab adds only the transport fixture correction to the rehearsed c057 runtime source. Both reset cases passed100 repetitions and all seven transport cases passed10 repetitions under the race detector. Complete final CI is tracked on this request.

Publication still requires an authorized protected release tag, an OpenPGP environment signing key, approved release-tag Pages deployment policy and the existing independent signing approvals. Hosting is configured; no public apt repository or ETH deployment is claimed by this change.

Related: #168, #275.