Integrate G15 submodules with Debian 13 packaging and devcontainer

.github/workflows/debian.yml

@@ -0,0 +1,72 @@
+name: Debian 13 packages
+on:
+  pull_request:
+    paths:
+      - 'packaging/**'
+      - '.github/**'
+      - '.devcontainer/**'
+      - '.gitmodules'
+      - '.gitignore'
+      - 'README.md'
+      - 'libg15'
+      - 'libg15render'
+      - 'g15daemon'
+      - 'g15macro'
+  workflow_dispatch:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+          submodules: recursive
+      - name: Build and validate in Debian 13
+        shell: bash
+        run: |
+          set -euo pipefail
+          for script in packaging/*.sh packaging/overlays/v1/*.sh .devcontainer/*.sh; do bash -n "$script"; done
+          # Real devcontainer CLI validation is a separate local check; see README.md.
+          docker run --rm -v "$GITHUB_WORKSPACE/.github:/repo/.github:ro" -w /repo \
+            rhysd/actionlint@sha256:887a259a5a534f3c4f36cb02dca341673c6089431057242cdc931e9f133147e9 \
+            .github/workflows/debian.yml
+          mkdir -p "$RUNNER_TEMP/debs"
+          bash packaging/run.sh "$RUNNER_TEMP/debs"
+          docker run --rm -v "$GITHUB_WORKSPACE/packaging:/checks/packaging:ro" \
+            -v "$GITHUB_WORKSPACE/.devcontainer:/checks/.devcontainer:ro" \
+            -w /checks g15-packaging bash -c 'shellcheck packaging/*.sh packaging/overlays/v1/*.sh .devcontainer/*.sh'
+          test -z "$(git submodule foreach --quiet --recursive 'git status --porcelain')"
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: debian13-amd64
+          path: ${{ runner.temp }}/debs/*
+          if-no-files-found: error
+
+  release:
+    if: github.event_name == 'release'
+    needs: build
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: debian13-amd64
+          path: artifacts
+      - name: Attach verified packages and sources
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          cd artifacts
+          sha256sum -c SHA256SUMS
+          gh release upload "$RELEASE_TAG" -- ./*