ci: add gated arm64 (.deb) release leg to debian-hll (hll -> citusdata/community)

[ibrahim halatci (ihalatci)]

What / why

Adds a gated arm64 .deb release leg to the debian-hll release build+publish workflow so
arm64 hll packages land in citusdata/community — the apt index that feeds the stable
Debian Citus Docker images. hll is a stable Citus dependency (hll=2.19.citus-1), pinned by the
Docker images, so it must ship arm64 for the images to install on arm64.

Mirrors the merged nightly leg #1198 and the all-citus release leg
#1205. Part of Track 2 of citusdata/citus#8612 (ARM64 Debian Docker images).

The gate (amd64 unchanged)

Everything arm64 is behind the DEB_BUILD_MULTI_ARCH repo variable, default OFF:

arch: ${{ fromJSON(vars.DEB_BUILD_MULTI_ARCH == 'true' && '["amd64", "arm64"]' || '["amd64"]') }}

• Gate OFF (default): arch = ["amd64"] → matrix = platform × ["amd64"], every leg on
  ubuntu-latest, all if: matrix.arch == 'arm64' steps skipped. Existing amd64 pipeline is
  byte-for-byte unchanged.
• Gate ON: arm64 runs on native ubuntu-24.04-arm runners. The matrix is deb-only, so no
  RPM exclude block is needed.
• Publish is doubly safe: upload_to_package_cloud only publishes when current_branch == debian-hll.

How the arm64 leg builds (Option B — in-job image build)

The release workflow runs from the debian-hll branch, which carries no build tooling. The
arm64 leg builds its builder + signer images in-job by cloning develop's tooling:

• TEST=false ./update_image → builds citus/packaging:<distro>-all natively on arm64.
• docker build … dockerfiles/debsigner/Dockerfile → builds citusdata/packaging:debsigner.

The same citus/packaging:<distro>-all builder image builds all three projects (citus/hll/topn) —
the package inputs are mounted at runtime. citus_package's docker run has no --platform
flag and prefers a local image, so the native arm64 images are picked up automatically. amd64
keeps pulling the published images from Docker Hub (Docker Hub login is itself gated to arm64).

Scope (surgical)

One file: .github/workflows/build-package.yml (+31 / −1). No changes to debian/control.in
(already Architecture: any), the deb entrypoint, or the upload script → version strings are
identical to amd64 by construction (hll=2.19.citus-1), satisfying the Docker exact-version pins.

Prerequisite

Requires the develop jq fix #1204 merged first (arm64 builder images are
cloned from develop). Nothing here runs until both #1204 is merged and the operator flips
DEB_BUILD_MULTI_ARCH on.

Guardrails

• Draft — do not merge / mark ready without operator go.
• Gate OFF — DEB_BUILD_MULTI_ARCH unset ⇒ amd64 only.
• Validated: YAML parse OK, actionlint clean (no warnings).