reauktion-home-ca: add Arch + Debian packaging and CI publish jobs

The package was referenced in memory as already published but never
actually existed in this repo or on packages.reauktion.de — only an
unpublished Arch build was staged on hertz. Adds real PKGBUILD +
dpkg-deb packaging (cert committed alongside, no upstream tarball)
and wires both into build.yml following the lmcp/aish dual-arch +
debian publish pattern.

debian/reauktion-home-ca/build-deb.sh

@@ -0,0 +1,60 @@
+#!/bin/bash
+# Build reauktion-home-ca_<ver>_all.deb from this directory using dpkg-deb
+# directly. Run from inside the runner container, which has dpkg installed.
+#
+# No upstream tarball: this is PKI trust material (the reauktion.de Home CA
+# root cert), not software with its own release cadence. The .crt is
+# committed alongside this script instead of being fetched.
+set -euo pipefail
+
+PKGVER=20260716
+PKGREL=1
+HERE=$(dirname "$(readlink -f "$0")")
+
+# Reproducible build: pin all file mtimes + ar member timestamps so repeat
+# builds produce identical bytes (reprepro refuses re-includes otherwise).
+export SOURCE_DATE_EPOCH=1784505600
+
+work=$(mktemp -d)
+trap "rm -rf $work" EXIT
+
+ROOT="$work/pkgroot"
+mkdir -p "$ROOT/DEBIAN" \
+         "$ROOT/usr/local/share/ca-certificates" \
+         "$ROOT/usr/share/doc/reauktion-home-ca"
+
+install -m 644 "$HERE/reauktion-home-ca.crt" \
+    "$ROOT/usr/local/share/ca-certificates/reauktion-home-ca.crt"
+
+cp "$HERE/debian/copyright" "$ROOT/usr/share/doc/reauktion-home-ca/copyright"
+cp "$HERE/debian/changelog" "$ROOT/usr/share/doc/reauktion-home-ca/changelog.Debian"
+gzip -9 -n "$ROOT/usr/share/doc/reauktion-home-ca/changelog.Debian"
+
+install -m 755 "$HERE/debian/postinst" "$ROOT/DEBIAN/postinst"
+install -m 755 "$HERE/debian/postrm"   "$ROOT/DEBIAN/postrm"
+
+cat > "$ROOT/DEBIAN/control" <<EOF
+Package: reauktion-home-ca
+Version: ${PKGVER}-${PKGREL}
+Section: admin
+Priority: optional
+Architecture: all
+Depends: ca-certificates
+Maintainer: Markus Fritsche <mfritsche@reauktion.de>
+Homepage: https://git.reauktion.de/marfrit/marfrit-packages
+Description: reauktion.de Home CA trust anchor for internal *.fritz.box HTTPS
+ Installs the private, name-constrained root CA used to sign internal
+ *.fritz.box and reauktion.de HTTPS services, so clients don't need -k
+ or browser exceptions to reach them.
+ .
+ Name constraints permit only fritz.box, reauktion.de, and localhost —
+ a leaked key can forge certificates for no other domain.
+ .
+ SHA256 fingerprint:
+ A3:32:17:6D:17:CF:F7:24:23:05:88:E0:6A:5E:5A:37:82:B9:BA:B5:BC:A1:2E:52:E3:88:3C:54:19:8B:F9:86
+EOF
+
+# Build the .deb. Output to current dir of the caller.
+DEB_OUT=reauktion-home-ca_${PKGVER}-${PKGREL}_all.deb
+dpkg-deb --root-owner-group --build "$ROOT" "$HERE/$DEB_OUT"
+echo "built: $HERE/$DEB_OUT"