feat(tmachine): build local Debian package artifacts #4597

User Story

As an OpenShell contributor using tmachine to qualify package-installed gateways, I need to build a Debian package from my local checkout so I can test the candidate binaries without downloading an older release package.

Description

Add local Debian artifact tooling to tmachine's Nix build commands. The binaries task should build and stage all package inputs, including the prover and VM driver with its embedded Linux runtime. A separate DEB task should only package those staged inputs and produce the stable artifact path consumed by tmachine's DEB installer.

Context

Split the independently useful Debian build tooling out of #4460 and PR #4461. This task covers local packaging only; the Docker CDI fixtures and test suite remain separate.

Definition of Done

• nix run .#build-artifacts-binaries builds and stages the DEB's required Linux binaries.
• nix run .#build-artifacts-deb only packages the staged binaries and writes artifacts/packages/openshell.deb.
• nix run .#build-artifacts runs the binaries task before DEB packaging.
• Local package-version overrides and architecture selection are documented.
• Linux VM runtime inputs use verified checksums, and the package can be built and inspected on a supported local host.