Publish .deb on stable tag + add Linux smoke test

Parent: #123

Release workflow publishes new `.deb` files to the APT repo (__L4__) + GitHub Releases on every stable tag, and a Linux CI job runs the full smoke install path.

## Definition of done

Publish:
- Tag push triggers a workflow job that takes the artifacts from __L1__, signs them, uploads them to the APT repo, and refreshes `Release`/`InRelease` metadata.
- Same artifacts also uploaded as GitHub Release assets for direct-download fallback.

Smoke test (`ubuntu-latest` job, run on release-candidate tags + manual dispatch):
1. Add APT source + import GPG key per the documented install instructions.
2. `apt-get update && apt-get install fallout-agent`.
3. Assert the `fallout-agent` system user exists and the unit is installed but not started (per __L2__).
4. `systemctl start fallout-agent`; assert it transitions to `active (running)`.
5. Mocked coordinator handshake — agent reaches a local stub, returns "enrolled".
6. `apt-get purge fallout-agent`; assert unit, user, and `/etc/fallout-agent/` are gone.
7. Job exits 0 only if all six assertions succeed.