[BUILD] Release tags never trigger build-deb/build-rpm: tags are pushed with GITHUB_TOKEN by the delivery workflows

### Describe the bug

`build-deb.yml` / `build-rpm.yml` are meant to run on every release tag (`[0-9]*` and `v[0-9]*`, with `+backend` tags skipped — #796). In practice **no tag has ever triggered them**: `0.6.1` (2026-08-13), `0.6.1+*`, `0.6.2a1` (2026-08-25) all show zero packaging runs, and the only tag-event runs on record are `skipped` ones for `+backend` tags.

### Cause

All release tags are created by `flagtree-bot` inside the `*-delivery.yml` workflows, which push them with the workflow's own `GITHUB_TOKEN`:

```yaml
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
...
git remote set-url origin https://x-access-token:${GITHUB_TOKEN}@github.com/${{ github.repository }}.git
git push --force origin "${TAG}"
```

GitHub deliberately does not fire `push` (or any other) events for refs created with `GITHUB_TOKEN`, to prevent recursive workflow runs ([docs](https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#using-the-github_token-in-a-workflow)). So the trigger pattern in the packaging workflows is correct but can never match; the glob fix in #796 could not have helped.

Verified with `gh api repos/flagos-ai/FlagTree/actions/runs?branch=0.6.1` → empty, and the tagger of `0.6.1` / `0.6.2a1` is `flagtree-bot` (`git for-each-ref --format='%(taggername)'`).

### Options

1. **Dispatch from the delivery workflow** — after the tag is pushed, call `gh workflow run build-deb.yml --ref "$TAG"` (and `build-rpm.yml`). Smallest change; keeps `GITHUB_TOKEN`; the packaging workflows already accept `workflow_dispatch`.
2. **Push the tag with a PAT or GitHub App token** instead of `GITHUB_TOKEN`, so the normal `push: tags:` trigger fires. Also makes any other tag-triggered workflow work, but needs a new secret and broader permissions.
3. Make the packaging jobs part of the delivery workflow itself (`workflow_call`). Cleanest long-term, largest diff.

I'd suggest (1) now and (3) when the delivery workflows are next refactored. Happy to send the PR for (1).

This also matters for FEP-0019 (flagos-ai/community#59): the FlagTree deb/rpm on FlagOS Nexus can only be produced by manual `workflow_dispatch` until this is fixed.

Start by reading the *-delivery.yml workflows and build-deb.yml/build-rpm.yml, focusing on how tags are pushed and how the packaging workflows accept workflow_dispatch. Implement the dispatch approach described in the issue, then verify that a release tag produces packaging workflow runs rather than only skipped tag-event runs.

Written by the indexing model from the issue text.