deb: unmount and remove the ephemeral chroot on Ctrl-C

The SIGINT handler libc::_exit(130)s, skipping EphemeralContextGuard's
drop and leaking the freshly bootstrapped chroot with its bind-mounted
/proc and overlay mounts. Resources now register a self-contained
cleanup hook in a process-global registry that the handler drains right
before exiting: the hook unmounts everything under the chroot path
(children first, lazy fallback) and removes the tree, using only stored
paths and direct umount/rm subprocesses so it cannot deadlock on a lock
the interrupted thread may hold; sudo -n keeps it from ever hanging on
a password prompt. Drop deregisters the hook first, so the normal
cleanup path is unchanged.

Also fixes the hex grouping of the CRC-24 polynomial in apt::release.

src/deb/mod.rs

@@ -1,5 +1,7 @@
 mod cross;
-mod ephemeral;
+/// Ephemeral (per-build) unshare contexts, including the process-global
+/// cleanup-hook registry drained by the SIGINT handler
+pub(crate) mod ephemeral;
 mod local;
 
 use crate::context::{self, Context};