feat(packaging): add Debian packaging and APT repository scripts

debian/DEBIAN/control: package metadata, depends on python3.11+, postgresql-client
debian/DEBIAN/postinst: creates activeblue-ai system user, installs venv, enables service
debian/DEBIAN/prerm: stops and disables service before removal
debian/DEBIAN/postrm: purge removes config, logs, venv, and system user
debian/lib/systemd/system/activeblue-ai.service:
  - Runs as dedicated user with PrivateTmp + ProtectSystem hardening
  - EnvironmentFile=/etc/activeblue-ai/.env
  - Restart=on-failure with 5s backoff
debian/usr/bin/activeblue-ai: CLI with start/stop/restart/status/logs/migrate/health/sweep/privacy/version
build_deb.sh: builds activeblue-ai_X.Y.Z_all.deb in dist/
publish_repo.sh: scans packages, generates Release + checksums, optional GPG signing

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

debian/usr/bin/activeblue-ai

@@ -0,0 +1,99 @@
+#!/bin/bash
+# ActiveBlue AI CLI tool
+set -e
+
+SERVICE_DIR="/usr/lib/activeblue-ai"
+VENV="$SERVICE_DIR/venv"
+CONFIG="/etc/activeblue-ai/.env"
+PYTHON="$VENV/bin/python3"
+
+if [ ! -f "$CONFIG" ]; then
+    echo "ERROR: Config not found at $CONFIG" >&2
+    exit 1
+fi
+
+export $(grep -v '^#' "$CONFIG" | grep -v '^$' | xargs 2>/dev/null) 2>/dev/null || true
+
+cmd="${1:-help}"
+shift || true
+
+case "$cmd" in
+    start)
+        echo "Starting ActiveBlue AI service..."
+        systemctl start activeblue-ai.service
+        ;;
+    stop)
+        echo "Stopping ActiveBlue AI service..."
+        systemctl stop activeblue-ai.service
+        ;;
+    restart)
+        echo "Restarting ActiveBlue AI service..."
+        systemctl restart activeblue-ai.service
+        ;;
+    status)
+        systemctl status activeblue-ai.service
+        ;;
+    logs)
+        journalctl -u activeblue-ai.service -f "${@}"
+        ;;
+    migrate)
+        echo "Running Alembic migrations..."
+        cd "$SERVICE_DIR"
+        "$VENV/bin/alembic" -c agent_service/migrations/alembic.ini upgrade head
+        ;;
+    health)
+        PORT="${AGENT_SERVICE_PORT:-8001}"
+        curl -sf "http://localhost:${PORT}/health/detailed" | python3 -m json.tool
+        ;;
+    sweep)
+        PORT="${AGENT_SERVICE_PORT:-8001}"
+        AGENTS="${1:-}"
+        if [ -n "$AGENTS" ]; then
+            curl -sf -X POST "http://localhost:${PORT}/sweep" \
+                -H 'Content-Type: application/json' \
+                -d "{\"agents\": [\"$AGENTS\"]}" | python3 -m json.tool
+        else
+            curl -sf -X POST "http://localhost:${PORT}/sweep" \
+                -H 'Content-Type: application/json' \
+                -d '{"agents": []}' | python3 -m json.tool
+        fi
+        ;;
+    privacy)
+        MODE="${1:-}"
+        if [ -z "$MODE" ]; then
+            echo "Current privacy mode: ${LLM_PRIVACY_MODE:-local}"
+        else
+            sed -i "s/^LLM_PRIVACY_MODE=.*/LLM_PRIVACY_MODE=$MODE/" "$CONFIG"
+            echo "Privacy mode set to: $MODE"
+            echo "Restart the service for changes to take effect: activeblue-ai restart"
+        fi
+        ;;
+    version)
+        cat "$SERVICE_DIR/VERSION" 2>/dev/null || echo "0.1.0"
+        ;;
+    help|--help|-h)
+        cat <<'HELP'
+ActiveBlue AI — CLI tool
+
+Usage: activeblue-ai <command> [options]
+
+Commands:
+  start           Start the agent service
+  stop            Stop the agent service
+  restart         Restart the agent service
+  status          Show systemd service status
+  logs [flags]    Follow service logs (passes flags to journalctl)
+  migrate         Run Alembic database migrations
+  health          Show detailed health status
+  sweep [agent]   Trigger a proactive sweep (all agents or named agent)
+  privacy [mode]  Get or set LLM privacy mode (local|hybrid|cloud)
+  version         Show installed version
+  help            Show this help
+HELP
+        ;;
+    *)
+        echo "Unknown command: $cmd" >&2
+        echo "Run 'activeblue-ai help' for usage." >&2
+        exit 1
+        ;;
+esac