feat(release): add Debian package publishing

[drew]

Summary

Add Debian package publishing for OpenShell development and tagged releases. The package installs the openshell CLI, openshell-gateway, openshell-driver-vm, and a user-scope openshell-gateway.service for running a local VM-backed gateway on 127.0.0.1:17670.

The branch also adds the install-dev.sh development installer, Debian version generation, release workflow integration for .deb artifacts, and the gateway/runtime changes needed for the packaged user service.

Related Issue

None.

Changes

• Added reusable Linux VM-driver and Debian-package workflows for amd64 and arm64.
• Updated dev and tagged release workflows to compute Debian versions, build .deb packages, include them in release checksums, and upload them as release assets.
• Added deploy/deb/ package authoring files: control.in, user-scope systemd unit, and maintainer scripts.
• Added tasks/scripts/package-deb.sh to stage pre-built binaries, render package metadata, build with dpkg-deb, inspect contents, and smoke-test the packaged binaries.
• Added tasks/scripts/package-deb-install.sh and hidden mise tasks for local package build/install testing.
• Added root install-dev.sh to download the rolling dev Debian package, verify checksums, install it, start the user gateway service when possible, and register a local gateway.
• Added --bind-address / OPENSHELL_BIND_ADDRESS to openshell-gateway; the packaged unit binds the gateway to loopback on port 17670.
• Installed openshell-driver-vm under /usr/libexec/openshell and added that directory to the VM driver search path.
• Updated VM gateway defaults so the packaged user service can run VM-backed sandboxes without a baked-in SSH handshake secret.
• Updated gateway architecture docs for the new bind address and driver search path.
• Restored .markdownlint-cli2.jsonc to match origin/main.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checks run:

• git rebase origin/main
• git push origin deb-pkg
• mise run markdown:lint:md
• sh -n install-dev.sh deploy/deb/postinst.sh deploy/deb/prerm.sh deploy/deb/postrm.sh
• bash -n tasks/scripts/package-deb.sh tasks/scripts/package-deb-install.sh
• uv run python tasks/scripts/release.py get-version --deb
• cargo test -p openshell-server cli::tests::command_parses_bind_address --lib
• cargo test -p openshell-server cli::tests::command_defaults_bind_address_to_all_interfaces --lib
• cargo test -p openshell-server compute::vm::tests::resolve_driver_search_dirs_include_libexec_fallbacks --lib

Full mise run pre-commit was not rerun after the final rebase/update. Earlier local runs in this branch failed in test:rust because sandbox_create_keeps_sandbox_with_forwarding requires port 8080, which is already bound by Docker Desktop in this environment.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-1069.docs.buildwithfern.com/openshell

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.