Publish .deb on stable tag + add Linux smoke test

[ChrisonSimtian]

Parent: #123

Release workflow publishes new .deb files to the APT repo (L4) + GitHub Releases on every stable tag, and a Linux CI job runs the full smoke install path.

Definition of done

Publish:

• Tag push triggers a workflow job that takes the artifacts from L1, signs them, uploads them to the APT repo, and refreshes Release/InRelease metadata.
• Same artifacts also uploaded as GitHub Release assets for direct-download fallback.

Smoke test (ubuntu-latest job, run on release-candidate tags + manual dispatch):

1. Add APT source + import GPG key per the documented install instructions.
2. apt-get update && apt-get install fallout-agent.
3. Assert the fallout-agent system user exists and the unit is installed but not started (per L2).
4. systemctl start fallout-agent; assert it transitions to active (running).
5. Mocked coordinator handshake — agent reaches a local stub, returns "enrolled".
6. apt-get purge fallout-agent; assert unit, user, and /etc/fallout-agent/ are gone.
7. Job exits 0 only if all six assertions succeed.