M2.3: Harden custom package pipeline (upgrade tests + .deb publish path)

[mshafiee]

Acceptance criteria

• Upgrade-path tests cover custom Zurvan packages (zurvan-base-files, zurvan-dns-bypass) — not just the base ISO
• publish-repo.yml in apt-repository handles new .deb uploads end-to-end (upload → index regen → sign → verify)
• zurvan-base-files publish path to the custom APT repo is defined (currently built in CI and staged locally only — see technical-spec-architecture.md §6)
• CI gate for custom packages: lint + build .deb + publish (per testing-qa-checklist.md §0 / github-project-management.md §7)

Scope

Per project-next-steps.md M2.3 "Custom Package Pipeline Hardening":

• Add upgrade-path tests for custom packages.
• Ensure publish-repo.yml handles new .deb uploads end-to-end.

Dependencies

• M1.2 APT repo publish pipeline stable
• M2.2 zurvan-dns-bypass package built and published

Notes

iso-builder#9 added base upgrade-path validation; this milestone extends coverage to the in-house custom packages and the full .deb publish path.