ISSUE-7275: Staging job should use pre-built deb packages

[herbenderbler]

Description

Staging no longer builds debs on the GCE host. It reuses the artifact from the
latest successful Package builds run for the current commit, and falls back
to building on a GitHub-hosted runner only when no run exists for that SHA.

Supersedes #7798 to use the corrected branch name.

Implementation Details

• New .github/workflows/build-debs-reusable.yml builds noble debs (server,
  OSSEC, app-code, config, keyring, admin) plus a trixie-built
  securedrop-admin. The trixie variant is required because the GCE host is
  trixie and the staging converge invokes securedrop-admin generate_v3_keys
  on localhost (roles/tor-hidden-services); the admin deb's bundled venv
  is ABI-tied to its builder image's Python. Artifact ships
  build/noble/ and build/trixie/.
• .github/workflows/build.yml now calls the reusable workflow;
  reproducible-debs updated for the new layout and adds the trixie admin
  deb to its diffoscope check.
• .github/workflows/staging.yml adds resolve-debs (uses gh run list /
  gh run download to grab noble-one for the SHA) and a fallback
  build-debs job; the staging job downloads staging-debs-noble into
  build/ and exports CI_PREBUILT_DEBS=1. Drops the prior
  workflow_dispatch opt-in toggle now that strict reuse is the default.
• devops/gce-nested/gce-runner.sh rsyncs both deb subdirs to GCE, skips
  on-host make build-debs-* under CI_PREBUILT_DEBS=1, restores
  apt-get update before installing, and installs the trixie admin deb
  unconditionally.
• admin/bin/validate-gpg-key.sh: SC2329 shellcheck disable for the
  trap-invoked cleanup function (false positive on newer shellcheck).

Checklist

• documentation: CI/workflow change only; no product/dev docs updated.
• AppArmor: N/A.
• install/upgrade: no impact; same trixie admin deb installed during staging.
• dependency policy:
  no new app/locked dependencies.