feat(release): ship Debian packages for pkg.shortarrow.jp

[ShortArrow]

Closes #65.

What the release now carries

Each release attaches runex_<version>-1_amd64.deb and runex_<version>-1_arm64.deb, built from the musl binaries, and a SHA256SUMS over every asset. These are what pkg.shortarrow.jp indexes: the registry checks each package against SHA256SUMS and fails a release that has packages without it. A pre-release tag v0.2.0-rc.1 gives the package version 0.2.0~rc.1, which sorts before 0.2.0.

Built with dpkg-deb, as gitreant does

The package is assembled by packaging/apt/build-deb.sh with dpkg-deb, which the Ubuntu runners already have, in the same layout and versioning as gitreant's packages for the same registry. cargo-deb would need less code but adds a third-party tool to the release job, and its output would differ from gitreant's.

No Depends

The binary is statically linked, and the package declares no Depends, so the .deb also installs on its own with apt install ./runex_…deb. gitreant's package depends on shortarrow-archive-keyring; here the keyring is installed by name, as the registry's install steps already say, and a lone .deb does not need it.

The install check

packaging/apt/install-test.sh installs the package in debian:bookworm, ubuntu:22.04 and ubuntu:24.04 twice: from a throwaway repository signed with a key made for the run, beside a stand-in keyring package, and as a lone file. Each time runex version must print the version and nothing on stderr. It runs in CI on every pull request, replacing the bare runex version run added by #66, and in the release job before the package is uploaded.

release.yml runs only on a tag, so the new packaging step is first exercised by the next release; it calls the same scripts CI runs, and the SHA256SUMS snippet was run on stand-in assets.