Add the Debian/apt analog of github_rpm: a metadata-only remote that scans
a GitHub repo's releases for .deb assets, derives per-asset control metadata
via a ranged prefix fetch (never downloading whole packages), synthesizes a
flat apt repository, and redirects .deb downloads to a backend releases_remote.
- Add PackageGitHubDeb to the package-type enum + validity map.
- Add the github_deb provider (internal/provider/deb/github.go): ServeRemote
serves Packages/Packages.gz/Release, 404s the signed index variants
(consumed via [trusted=yes]), and 302-redirects *.deb to the releases_remote;
deriveAsset ranged-GETs the ar prefix, locates control.tar.*, and parses the
control paragraph, doubling the range on truncation; sha256 comes from the
asset digest when present, else a one-time full stream.
- Add the github_deb background Syncer (internal/provider/deb/syncer.go): its
own worker pool, shared rate limiter, deduped queue, and DB-lease-gated scans.
- Add github_deb_sync_state table plus ListGitHubDebRemotes/Claim/Release DB
helpers (separate from the rpm ones).
- Prime github_deb remotes on create and run the deb syncer alongside the rpm
one; route prime-on-create by package type.
- Reuse the deb apt-index generators and control parser; skip empty hash lines
in the Packages index so a SHA256-only metadata entry is valid.
