feat(ci): skip .deb rebuild when version already published

build-deb now checks the Debian registry first and skips the slow source
compile+upload when the pinned version already exists. Add a force_deb
workflow_dispatch input to rebuild anyway, and make upload.sh idempotent
(HTTP 409 -> already published, skip).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packaging/deb/upload.sh

@@ -31,11 +31,19 @@ if [ "${#debs[@]}" -eq 0 ]; then
   exit 1
 fi
 
+uploaded=0
+skipped=0
 for file in "${debs[@]}"; do
   echo "Uploading ${file} -> ${upload_url}"
-  curl -fsSL --user "${DEB_USER}:${DEB_PASS}" \
+  code="$(curl -sS -o /tmp/deb-upload.out -w '%{http_code}' \
+    --user "${DEB_USER}:${DEB_PASS}" \
     --upload-file "./${file}" \
-    "${upload_url}"
+    "${upload_url}")"
+  case "$code" in
+    20*) echo "  ok ($code)"; uploaded=$((uploaded + 1)) ;;
+    409) echo "  already published ($code), skipping"; skipped=$((skipped + 1)) ;;
+    *)   echo "  upload failed (HTTP $code):" >&2; cat /tmp/deb-upload.out >&2; exit 1 ;;
+  esac
 done
 
-echo "Uploaded ${#debs[@]} package(s)"
+echo "Done: ${uploaded} uploaded, ${skipped} already present"