pkg: build a local .deb; de-duplicate onto DAEMON's systemd/nativehost/man page

DAEMON landed packaging/nativehost/, packaging/systemd/{velox.service,velox.socket}
(real sd_listen_fds() socket activation) and cli/man/velox.1 on main while this was
in flight, duplicating paths this branch had drafted independently. Per CLAUDE.md
(packaging/nativehost/ is DAEMON's; the rest of packaging/ is PKG/QA's), DAEMON's
copies are kept as the single source and this branch's packaging/native-messaging/,
packaging/man/velox.1 and stale packaging/systemd/velox.service are dropped rather
than maintained twice. The root CMakeLists.txt's install() rules now point at
DAEMON's paths directly, install both systemd units (not just velox.service), and
docs/07-packaging.md / packaging/README.md no longer claim there's no socket
activation — there is, and this package now ships it.

Adds the local-test-only .deb itself: debian/{control,rules,postinst,postrm,
changelog,copyright}, a placeholder icon set, the desktop entry and PKG/QA's own
man pages (veloxd.8, velox-gui.1 — velox.1 stays DAEMON's). libveloxcore stays
static (no consumer needs a .so yet); pairing has no real approval UI in this
build (D1 unbuilt), so postinst and packaging/README.md both say VELOX_PAIR_AUTO=1
is required and print it prominently. No PPA, no GPG — local dpkg -i only.

Verified live: dpkg-buildpackage -us -uc -b, dpkg -i, socket activation (systemctl
--user enable --now velox.socket), `velox ls` against the running daemon, lintian
clean, dpkg -r removes the manifest/units and leaves $XDG_DATA_HOME/velox alone.

.gitignore now excludes dpkg-buildpackage's debhelper build tree and obj-*/ (the
debuild output dir) — debian/control et al. stay tracked, everything debhelper
regenerates does not.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_0176u3fTrxegrGNm2yC7r69W

CMakeLists.txt

@@ -105,3 +105,63 @@ if(VELOX_BUILD_TESTS)
         endif()
     endforeach()
 endif()
+
+# --- Install rules (M6 packaging; docs/07-packaging.md; owned by PKG/QA) ------------
+#
+# Guarded by `if(TARGET ...)`, not by editing each lane's own CMakeLists.txt: install()
+# is a packaging concern, and reaching into daemon/CMakeLists.txt (DAEMON's), cli's build
+# file (also DAEMON's) or gui/CMakeLists.txt (GUI's) to add it there would cross a lane
+# boundary CLAUDE.md draws on purpose. Every target below is defined by its own lane;
+# this only says where the packaged binary already built by that lane's rules goes.
+#
+# libveloxcore is intentionally absent here: it stays a static library linked into each
+# binary (user decision, see docs/07-packaging.md) — there is no .so to install.
+#
+# CMAKE_INSTALL_LIBDIR is multiarch-adjusted (lib/x86_64-linux-gnu/) by GNUInstallDirs on
+# Debian; systemd user units and the Mozilla native-messaging directory are NOT
+# architecture-specific paths, so those two destinations are written literally
+# (lib/systemd/user, lib/mozilla/...) rather than built from that variable.
+include(GNUInstallDirs)
+
+if(TARGET veloxd)
+    install(TARGETS veloxd RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
+    install(FILES ${CMAKE_SOURCE_DIR}/packaging/man/veloxd.8
+            DESTINATION ${CMAKE_INSTALL_MANDIR}/man8)
+    # velox.socket ships alongside velox.service: DAEMON wired real sd_listen_fds()
+    # socket activation (daemon/src/rpc/systemd_activation.cpp) — see
+    # packaging/systemd/README.md for the pair's own rationale.
+    install(FILES ${CMAKE_SOURCE_DIR}/packaging/systemd/velox.service
+                  ${CMAKE_SOURCE_DIR}/packaging/systemd/velox.socket
+            DESTINATION lib/systemd/user)
+endif()
+
+if(TARGET velox)
+    install(TARGETS velox RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
+    # DAEMON owns cli/ and its man page (CLAUDE.md); packaging only installs it.
+    install(FILES ${CMAKE_SOURCE_DIR}/cli/man/velox.1
+            DESTINATION ${CMAKE_INSTALL_MANDIR}/man1)
+endif()
+
+if(TARGET velox-gui)
+    install(TARGETS velox-gui RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
+    install(FILES ${CMAKE_SOURCE_DIR}/packaging/man/velox-gui.1
+            DESTINATION ${CMAKE_INSTALL_MANDIR}/man1)
+    install(FILES ${CMAKE_SOURCE_DIR}/packaging/desktop/velox.desktop
+            DESTINATION ${CMAKE_INSTALL_DATADIR}/applications)
+    foreach(iconsize 16 22 24 32 48 64 128 256)
+        install(FILES
+                ${CMAKE_SOURCE_DIR}/packaging/icons/hicolor/${iconsize}x${iconsize}/apps/velox.png
+                DESTINATION ${CMAKE_INSTALL_DATADIR}/icons/hicolor/${iconsize}x${iconsize}/apps)
+    endforeach()
+endif()
+
+# nmhost and its manifest are DAEMON's (CLAUDE.md: nmhost/ and packaging/nativehost/).
+# This lights up the moment DAEMON's target exists, the same way the add_subdirectory()
+# guards above do — no coordinated edit needed when it lands.
+if(TARGET velox-nmhost)
+    install(TARGETS velox-nmhost RUNTIME DESTINATION libexec/velox)
+    install(FILES ${CMAKE_SOURCE_DIR}/packaging/nativehost/com.velox.host.json
+            DESTINATION lib/mozilla/native-messaging-hosts)
+else()
+    message(STATUS "velox: nmhost has not landed yet — native-messaging manifest not installed.")
+endif()