lmcp: Debian packaging + CI publish via hertz reprepro

- debian/lmcp/build-deb.sh fetches the v0.3.0 tarball, lays out the
  filetree, and uses dpkg-deb to assemble lmcp_0.3.0-1_all.deb directly
  on the Arch aarch64 runner (no debhelper needed for a pure-Lua pkg).
- workflow job 'lmcp-debian' rsyncs the .deb to hertz's marfritrepo
  incoming dir, then ssh-triggers 'publish-deb <suite>' for both
  bookworm and trixie. publish-deb wraps 'reprepro includedeb' and
  rsyncs dists/+pool/ to nc.
- New secret MARFRIT_REPO_HERTZ_KEY uploaded to Gitea repo. Forced
  command on hertz routes rsync uploads vs publish-deb triggers.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/build.yml

@@ -99,7 +99,56 @@ jobs:
 
       - name: wipe secrets
         if: always()
-        run: rm -f /root/repo_pass /root/.ssh/id_ed25519
+        run: rm -f /root/repo_pass /root/.ssh/id_ed25519 /root/.ssh/id_ed25519_hertz
+
+  # -------------------------------------------------------------------------
+  # lmcp Debian (Architecture: all) — built on the aarch64 runner using
+  # dpkg-deb (Arch ships dpkg in extra). The .deb is rsynced to hertz's
+  # incoming dir, then we trigger 'publish-deb' on hertz which runs
+  # reprepro and mirrors dists/+pool/ to nc.
+  # -------------------------------------------------------------------------
+  lmcp-debian:
+    needs: lmcp-any   # serialize after the Arch build to share the runner
+    runs-on: arch-aarch64
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: install dpkg
+        run: pacman -Syu --noconfirm --needed dpkg openssh rsync curl
+
+      - name: install hertz deploy ssh key
+        env:
+          KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
+        run: |
+          mkdir -m700 -p /root/.ssh
+          printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz
+          chmod 600 /root/.ssh/id_ed25519_hertz
+          ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
+
+      - name: build lmcp .deb
+        run: |
+          set -e
+          cd debian/lmcp
+          ./build-deb.sh
+          ls -la *.deb
+
+      - name: upload + publish to suites
+        run: |
+          set -e
+          cd debian/lmcp
+          DEB=$(ls lmcp_*.deb | head -1)
+          # Push the .deb into hertz's incoming dir via rrsync.
+          rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \
+              marfritrepo@hertz.fritz.box:
+          # Trigger reprepro for each suite.
+          for suite in bookworm trixie; do
+              ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \
+                  "publish-deb $suite $DEB"
+          done
+
+      - name: wipe secrets
+        if: always()
+        run: rm -f /root/.ssh/id_ed25519_hertz
 
   # -------------------------------------------------------------------------
   # lmcp is pure Lua (arch=any). One build on the aarch64 runner produces a