ci(qualification): test DEB and RPM installation profiles

[SDAChess]

Description

Define the qualification policy for OpenShell installation profiles and add package-manager profiles for DEB and RPM candidate artifacts.

The policy keeps responsibilities explicit:

• scenarios configure the machine and runtime environment;
• installation profiles install and verify OpenShell;
• testsuites verify post-install behavior and stateful transitions.

The DEB and RPM profiles must install the exact candidate packages through the guest's native package manager and compose with the same scenarios and testsuites used by native installation.

Context

• Parent release pipeline: feat: 0.1.0 release pipeline #2860
• Native-install proof-of-concept pipeline: ci(qualification): run native Linux proof-of-concept pipeline #2976
• Completed reusable clean-install work: ci(qualification): add reusable clean-install flow #2974
• Installation profile model: refactor(tmachine): separate installation profiles #3419
• N-to-N+1 upgrade testsuite: ci(qualification): add reusable N-to-N+1 upgrade testsuite #2975
• Release policy: RFC-0014

The native profile establishes the proof-of-concept pipeline. Package installation is separate qualification work and is a prerequisite for package-based upgrade testing.

Definition of Done

• The installation-profile policy documents ownership, inputs, outputs, lifecycle, verification, diagnostics, and cleanup boundaries.
• A DEB profile installs candidate packages on Ubuntu 24.04 through the native package manager.
• An RPM profile installs candidate packages on Fedora through the native package manager.
• Both profiles consume immutable candidate artifacts without rebuilding or using floating dev artifacts.
• Both profiles verify installed package versions, candidate identity, expected services, and gateway health before a testsuite runs.
• Native, DEB, and RPM installations can run the same independently selected testsuite without scenario-specific forks.
• Failures retain package-manager, systemd, gateway, and scenario diagnostics without secrets.
• Documentation explains how to add another installation profile under the same policy.
• N-to-N+1 upgrade behavior remains in ci(qualification): add reusable N-to-N+1 upgrade testsuite #2975 rather than being embedded in an installation profile.

Out of Scope

• N-to-N+1 upgrade behavior
• Helm, Homebrew, Snap, MSI, and WinGet installation profiles