Add pinned Debian packaging and image recipes

[devteapot]

Summary

• add deterministic Debian packages for the SOS runtime, agent, desktop/appliance sessions, and first-boot image configuration
• add a digest- and snapshot-pinned Podman/Docker package builder with a clean-install verification path
• add package-only Debian 13 ARM64 QCOW2 and live-ISO recipes, input/output manifests, and documented VM workflows
• switch packaged login launchers to the private pinned Node runtime

Evidence

• bash -n passes for all added and modified shell entrypoints
• ShellCheck passes for all added and modified shell entrypoints
• ./tests/linux-packaging-host-test.sh passes
• git diff --check passes
• Podman built all five ARM64-compatible packages and a fresh pinned Debian container installed and verified them
• a same-input package rebuild was byte-for-byte identical
• the revised live-build run reached P: Build completed successfully and wrote a temporary ARM64 hybrid ISO

Known limitation

This is a draft because the live-ISO wrapper did not continue through its post-lb build copy, inspection, and manifest steps. The temporary ISO disappeared with the build volume, so there is not yet a retained ISO hash or VM boot result. The package build/install/reproducibility evidence is complete; ISO artifact handoff and boot verification remain follow-up gates documented in docs/progress.md.