Add CPack DEB packaging + release workflow (.deb per distro)

[gilesw]

Summary

Adds two things downstream consumers (Ansible roles, homelab installers,
people who don't want to cmake two C++ libs by hand) keep asking for:

1. CPack DEB configuration in CMakeLists.txt — cpack -G DEB
   produces a .deb from any local build. CPACK_DEBIAN_PACKAGE_SHLIBDEPS=ON
   makes dpkg-shlibdeps derive Depends: from the binary's actual
   library references, so the package picks up the right
   libavformatN / libfftw3-double3 etc. for the build host.

2. Tag-triggered release workflow (.github/workflows/release.yml)
   that runs the CPack DEB build in a per-distro container matrix and
   uploads the resulting .deb plus a .sha256 to the GitHub release.

The workflow builds libkeyfinder as a static library and links it
into the keyfinder-cli binary so the .deb is fully self-contained — the
only runtime deps are FFmpeg + fftw3, which apt resolves from the
distro archive.

Matrix

FFmpeg ABI differs across distros, so the .deb is per-distro:

• ubuntu24 (FFmpeg 6 / libavformat60) — Ubuntu 24.04, Debian bookworm
• debian13 (FFmpeg 7 / libavformat61) — Debian trixie, Ubuntu 25.04+

Both produce ~90KB packages.

Result

Consumers install with apt install ./keyfinder-cli_*_amd64.deb. No
/usr/local surgery, no ldconfig, no libkeyfinder build. Verified
on Debian trixie:

$ dpkg -I keyfinder-cli_1.2.0-prebuilt-3-debian13_amd64.deb | grep -E "Depends|Installed-Size"
 Depends: libavcodec61 (>= 7:7.1.4), libavformat61 (>= 7:7.1.4), libavutil59 (>= 7:7.1.4), libc6 (>= 2.34), libfftw3-double3 (>= 3.3.10), libgcc-s1 (>= 3.0), libstdc++6 (>= 13.1), libswresample5 (>= 7:7.1.4)
 Installed-Size: 329

$ ldd /usr/bin/keyfinder-cli | grep keyfinder
(empty — statically linked)

The existing per-push build workflow is untouched.

Test plan

• Tag pushed on a fork (gilesw/keyfinder-cli v1.2.0-prebuilt-3),
  workflow ran green for both matrix entries:
  https://github.com/gilesw/keyfinder-cli/releases/tag/v1.2.0-prebuilt-3
• Debian 13 .deb verified dpkg -i clean on real Debian trixie,
  Depends: resolved through apt, keyfinder-cli -n camelot <file>
  output as expected.
• Maintainer sanity check.

Notes

• The CMake add_executable name is keyfinder-cli (hyphen) which is
  what the .deb installs as. The legacy make install produced
  keyfinder_cli (underscore). Existing beets configs may need an
  update — minor downstream impact.
• Static linking lives at the workflow level (-DBUILD_SHARED_LIBS=OFF
  on libkeyfinder's build), not baked into CMakeLists.txt, so manual
  builds keep the original behavior.