Add Debian package build test and statically link bundled submodules

Add tests/test_deb_build.sh with four phases:
1. Build .deb packages via dpkg-buildpackage
2. Verify all three packages contain expected files (binaries, man
   pages, shared library, headers, pkg-config)
3. Install packages and resolve dependencies
4. Smoke-test installed binaries, ldconfig, and headers

Add a Linux-only CI step in build.yml to run the test.

Statically link the bundled submodule libraries (libcork, libipset,
libbloom) into all targets instead of building them as shared libs.
These are vendored code built from git submodules, not system
libraries, so static linking is correct and eliminates
dpkg-shlibdeps warnings about missing .so files.

Pass -DWITH_STATIC=OFF in debian/rules since debian build-depends
only provide shared library dev packages.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/build.yml

@@ -52,3 +52,11 @@ jobs:
           sudo apt-get install -y qemu-system-x86
           bash tests/test_redir_qemu.sh build/shared/bin/
         timeout-minutes: 8
+
+      - name: Debian package build test
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get install -y --no-install-recommends \
+            build-essential debhelper dpkg-dev fakeroot asciidoc-base xmlto pkg-config
+          bash tests/test_deb_build.sh
+        timeout-minutes: 10