deb,cli,test: add --mirror to build and resolve from a pinned mirror

Pinned runners (a caching proxy, a chosen mirror) must resolve every
package from one base URL. 'pkh deb --mirror <url>' passes the mirror
to mmdebstrap as its mirror positional, so the chroot tarball's apt
sources carry it from the bootstrap on and every apt inside the build
follows - no per-build source rewriting. The mirror must serve every
suite and architecture the build resolves (the security pocket and,
for cross builds, the target archive included); that contract is
documented, not enforced.

The tarball cache is keyed per mirror (a short sha prefix before the
'-buildd.tar.xz' suffix prune matches): a --mirror run over a stale
distro-default tarball would silently resolve from the distro, and
'--incremental' records must never fork across a mirror change.

The runtime source passes recognize the pinned URL as an archive
source (it carries no official host for the host-based checks): the
pocket pass and the universe pass treat it as the archive, and the
cross setup gives it every component and suite, no arch scoping (the
mirror serves every architecture by contract) and no ports entry.
'pkh test' passes no mirror: its tarballs stay distro-default.

README.md

@@ -191,6 +191,17 @@ A build killed hard (OOM) can leave its chroot behind; the next run of
 that target sweeps it (unmounting and escalating through sudo when
 needed), and `pkh prune` collects the rest.
 
+On a pinned runner — a machine that must resolve every package from one
+mirror, typically a caching proxy — `pkh deb --mirror <url>` builds the
+chroot and resolves every package from that base URL: the mirror is
+passed to mmdebstrap at bootstrap, so the chroot tarball's apt sources
+carry it and every apt inside the build follows. The mirror must serve
+every suite and architecture the build resolves (the security pocket
+and, for `--cross` builds, the target architecture's archive included);
+PPAs and other third-party sources are left alone. The tarball cache is
+keyed per mirror, so pinned and unpinned builds keep separate tarballs
+(and `--incremental` records never fork across a mirror change).
+
 ### Running the DEP-8 tests
 
 `pkh test` runs the package's as-installed tests (`debian/tests/control`,