Archive buildiers should create an md5sums file

A common idiom for distribution packages is to have an outer shell with metadata, and an inner payload of a compressed archive of files to install. For example, a .deb package is

- foo.deb
- `control.tar.gz`
- `debian-binary`
- `data.tar.xz`

Where control.tar contains the metadata files and data.tar contains the payload. For .deb files, the metadata is
- `control` - general info
- `md5sums` - a list of every file in the payload with its md5 hash
- install and uninstall scripts

## Alternatives
- We could read the tarball which is input to a .deb and compute the md5 file
- We could have the tar writer calculate the sums and write them as an additional output
- We could create a rule that takes pkg_* targets as inputs and calculates the md5.

The best choice is probably the first, because that is where we have built the map of sources to their destination paths. The md5 files would use destination paths.

The issue does not name a file or test. Start by tracing the .deb builder and the tarball input path, focusing on where source-to-destination mappings are available. Done means generated .deb metadata includes an md5sums file listing every payload path and its MD5 hash.

Written by the indexing model from the issue text.