apt upgrade keeps TuiCode up to date from a signed apt repository #417

Context

The attached .deb (#416) installs TuiCode but never updates: the user has to fetch the next one by hand. This task publishes a signed apt repository on GitHub Pages, refreshed by every release, so apt upgrade brings TuiCode along with everything else. Pitch: #44. Needs #416 merged first.

Waiting on the stakeholder for two things outside this repo:

• a GPG signing key, created by the stakeholder and stored in the release environment;
• support in a-team's shared release-publish.yml for pushing the rendered repo, the same way it pushes the Homebrew formula and Scoop manifest, released and pinned here. That needs an issue on mentaldesk/a-team.

Acceptance criteria

• On Debian 12 and Ubuntu 22.04 (amd64 and arm64), the README's three-step setup (fetch the key, add the source, sudo apt update && sudo apt install tuicode) installs TuiCode, as in the pitch's mockup.
• After the next release, sudo apt update && sudo apt upgrade on that machine moves TuiCode to the new version.
• apt reports no signature or Release file warnings.
• The README's Linux block shows the repo setup, and CONTRIBUTING's release section and diagram include the repo step and where the key lives.

Tests

• The release run builds the repo metadata from the .deb files apt and dnf install TuiCode from a package attached to each release #416 produces, signs it, and publishes it from main only, inside the release run (a release: published trigger won't fire).
• A post-publish check in a clean debian:12 container that adds the repo and installs the just-released version.
• A run without the key configured skips the repo step with a visible notice instead of failing the release.

Out of scope

• A dnf/Copr repository.
• The AUR (On Arch I can't install or update TuiCode with yay #383).
• Keeping more than the latest few versions in the repo.