As a Linux operator I can install fallout-agent via apt

## Story

As a Linux operator managing a CD target host, I want to install the Fallout deployment agent with `apt install fallout-agent` from a Fallout-hosted APT repository so I get a systemd-managed daemon that survives reboots and updates via `apt upgrade`, without resorting to curl-bash installers.

## Why

RFC #113 defines `fallout-agent` as a self-contained executable that operators run on hosts the forge runner can't reach. For Debian-family Linux hosts (Debian, Ubuntu, and downstreams — by far the dominant server distros), `.deb` + an APT repo is the expected install path. Curl-piped installers and bare tarballs both fail policy in serious shops; a signed APT source is the baseline.

## Acceptance criteria

Sub-tasks (filled in after creation):

- [ ] #134 — Build `.deb` for amd64 and arm64 (Debian 12 / Ubuntu 22.04 / 24.04 baselines)
- [ ] #135 — Ship systemd unit and maintainer scripts in the `.deb`
- [ ] #136 — GPG-sign packages and publish key fingerprint
- [ ] #137 — Host APT repository at a stable URL
- [ ] #138 — Publish `.deb` on stable tag + add Linux smoke test

## Out of scope

- RPM / Fedora / RHEL packaging — separate story when there's pull from that ecosystem.
- Snap / Flatpak — orthogonal distribution channels; revisit later.
- Pre-release / `unstable` suite — only stable channel for now.

## Related

- RFC #113 — CD deployment agent/runner
- RFC #106 — Continuous Delivery vision