feat: add signed APT repository publishing

.github/workflows/pages.yml

@@ -30,6 +30,26 @@ jobs:
           mkdir -p _site/docs
           cp website/* _site/
           cp -r book/book/* _site/docs/
+      - name: Download APT repository from latest release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          mkdir -p /tmp/apt-download
+
+          # Check if latest release has the apt-repo asset
+          if gh release view --json assets --jq '.assets[].name' --repo "${{ github.repository }}" 2>/dev/null | grep -qx 'apt-repo.tar.gz'; then
+            # Asset exists — download must succeed or we fail to avoid wiping the existing APT repo
+            gh release download --pattern 'apt-repo.tar.gz' --dir /tmp/apt-download --repo "${{ github.repository }}"
+            echo "Downloaded apt-repo.tar.gz from latest release"
+            mkdir -p _site/apt
+            tar -xzf /tmp/apt-download/apt-repo.tar.gz -C _site/apt/
+            echo "=== APT repo files included in site ==="
+            find _site/apt -type f | sort
+          else
+            echo "No apt-repo.tar.gz found in any release. Deploying docs only."
+            echo "This is expected before the first stable release with APT publishing."
+          fi
       - name: Upload artifact
         uses: actions/upload-pages-artifact@v3
         with: