sic: add sicd + sic-agent packages (Arch + Debian) + CI

sicd (daemon, target hosts) and sic-agent (client + agent skills) from
git.reauktion.de/marfrit/sic v0.1.0. Go binaries, cross-built with GOARCH.

- arch/sicd, arch/sic-agent: PKGBUILDs (build from source via go).
- debian/sicd, debian/sic-agent: control/copyright/changelog + build-deb.sh
  (per-arch amd64/arm64).
- .gitea/workflows/build.yml: 4 jobs — Arch aarch64 (repo-signed, -> nc) and
  Debian amd64+arm64 (-> hertz reprepro, bookworm+trixie). continue-on-error,
  chained after the existing jobs.

Validated locally: Arch aarch64 pkgs + Debian arm64/amd64 debs build; the
packaged sicd binary runs (netstring exec).

debian/sicd/build-deb.sh

@@ -0,0 +1,61 @@
+#!/bin/bash
+# Build sicd_<ver>_<arch>.deb using dpkg-deb. Mirrors the lmcp/claude-his-agent
+# pattern, plus a Go cross-build step (sicd is a compiled binary).
+#
+# Usage: ./build-deb.sh [amd64|arm64]     (default: host dpkg architecture)
+# Needs: go, dpkg-deb, curl.
+set -euo pipefail
+
+PKGVER=0.1.0
+PKGREL=1
+SIC_TARBALL_SHA256=5cd10c3a1ab7361e72e7579af5819f9d322ecd59424541cfb80e5b7514253511
+HERE=$(dirname "$(readlink -f "$0")")
+
+DEB_ARCH="${1:-$(dpkg --print-architecture)}"
+case "$DEB_ARCH" in
+    amd64) GOARCH=amd64 ;;
+    arm64) GOARCH=arm64 ;;
+    *) echo "unsupported arch: $DEB_ARCH (use amd64 or arm64)" >&2; exit 1 ;;
+esac
+
+# Reproducible build: pin mtimes + ar timestamps (v0.1.0, 2026-07-19 12:00 UTC).
+export SOURCE_DATE_EPOCH=1784462400
+
+work=$(mktemp -d)
+trap "rm -rf $work" EXIT
+cd "$work"
+
+curl -sSLfo sic.tar.gz \
+    "https://git.reauktion.de/marfrit/sic/archive/v${PKGVER}.tar.gz"
+echo "$SIC_TARBALL_SHA256  sic.tar.gz" | sha256sum -c
+tar xzf sic.tar.gz
+
+( cd sic && GOOS=linux GOARCH="$GOARCH" CGO_ENABLED=0 \
+    GOFLAGS='-buildvcs=false -trimpath' go build -ldflags='-s -w' -o sicd ./cmd/sicd )
+
+ROOT="$work/pkgroot"
+mkdir -p "$ROOT/DEBIAN" "$ROOT/usr/bin" "$ROOT/usr/share/doc/sicd"
+install -m755 sic/sicd            "$ROOT/usr/bin/sicd"
+install -m644 sic/gateway/sicd    "$ROOT/usr/share/doc/sicd/sicd-reference.py"
+install -m644 sic/docs/design.md  "$ROOT/usr/share/doc/sicd/design.md"
+install -m644 "$HERE/debian/copyright" "$ROOT/usr/share/doc/sicd/copyright"
+
+{
+    echo "Package: sicd"
+    echo "Version: ${PKGVER}-${PKGREL}"
+    echo "Architecture: ${DEB_ARCH}"
+    echo "Maintainer: Markus Fritsche <mfritsche@reauktion.de>"
+    echo "Section: net"
+    echo "Priority: optional"
+    echo "Recommends: openssh-server"
+    echo "Homepage: https://git.reauktion.de/marfrit/sic"
+    echo "Description: sic daemon — netstring argv over stdin, execvp'd"
+    echo " sicd reads netstring-framed argv from stdin and runs it with execvp,"
+    echo " so no shell re-parses the arguments. Deploy on target hosts and run"
+    echo " it over ssh (as the remote command, or command=\"sicd\" on a key)."
+} > "$ROOT/DEBIAN/control"
+
+OUT="$HERE/sicd_${PKGVER}-${PKGREL}_${DEB_ARCH}.deb"
+rm -f "$OUT"
+dpkg-deb --root-owner-group --build "$ROOT" "$OUT"
+echo "built $OUT"