test: add pkh test, the native DEP-8 runner for local and chroot

The DEP-8 run-time contract is one page, so pkh implements it natively
instead of wrapping autopkgtest (see plans/pkh-test.md): the testbed is
a pkh context — chroot mode reuses the deb ephemeral chroots and their
cached mmdebstrap tarballs, local mode runs on the current context —
and the binaries under test are the freshness-guarded pkh deb output
next to the tree, rebuilt through the deb flow when stale or missing.

Per test: restrictions gate on the testbed (isolation-machine,
needs-reboot and container isolation skip with a pointer at --mode vm),
the stanza Depends are expanded (@, @builddeps@, @recommends@) and
installed, then the script or Test-Command runs in the staged tree with
the AUTOPKGTEST_* (and legacy ADT_*) environment, a per-test timeout
and the stderr/exit-77 verdict rules; flaky tests retry once. stdout,
stderr and $AUTOPKGTEST_ARTIFACTS are collected per test under
/var/tmp/pkh/tests/ (pruned separately). --shell/--shell-fail drop
into the testbed for debugging.

pin_pocket and install_injected_packages become crate-internal helpers
shared with the deb flow, which they mirror.

src/deb/local.rs

@@ -1075,7 +1075,7 @@ fn options_declare_single_debian_patch(local_options: Option<&str>, options: Opt
 /// suite on every repository carrying it (archive, security and ports),
 /// for all architectures, so this also covers cross-builds pulling
 /// dependencies from 'ports.ubuntu.com'.
-fn pin_pocket(pocket_suite: &str, ctx: &Arc<Context>) -> Result<(), Box<dyn Error>> {
+pub(crate) fn pin_pocket(pocket_suite: &str, ctx: &Arc<Context>) -> Result<(), Box<dyn Error>> {
     let pin_path = format!("/etc/apt/preferences.d/pkh-{}", pocket_suite);
     let pin_content = format!(
         "Package: *\nPin: release a={}\nPin-Priority: 600\n",
@@ -1086,7 +1086,7 @@ fn pin_pocket(pocket_suite: &str, ctx: &Arc<Context>) -> Result<(), Box<dyn Erro
     Ok(())
 }
 
-fn install_injected_packages(
+pub(crate) fn install_injected_packages(
     packages: &[String],
     env: &HashMap<String, String>,
     ctx: Arc<Context>,