fix(release): harden deb and rpm packaging

[cxymds]

Summary

Hardens the DEB/RPM release path introduced in #346.

• Invoke packaging from the release workflow with the exact tag, build run ID, and source SHA; validate the run, tag, and source identity before packaging.
• Package the existing static musl Linux artifacts, remove the incorrect glibc dependency floor, and verify generated package metadata.
• Publish packages and merge SHA256SUMS in one aggregation job, preserving prerelease filenames and safely retaining existing release checksums.
• Publish R2 packages separately with package checksums, so an R2 outage does not block GitHub release assets.
• Pin fpm and document the static package payload.

Validation

• actionlint .github/workflows/package.yml .github/workflows/release.yml
• cargo fmt --all --check
• cargo clippy --workspace -- -D warnings
• cargo test --workspace

Notes

Release signing is intentionally left out because it requires a managed signing key and release-secret policy.