deb,cli,test: add --mirror to build and resolve from a pinned mirror

Pinned runners (a caching proxy, a chosen mirror) must resolve every
package from one base URL. 'pkh deb --mirror <url>' passes the mirror
to mmdebstrap as its mirror positional, so the chroot tarball's apt
sources carry it from the bootstrap on and every apt inside the build
follows - no per-build source rewriting. The mirror must serve every
suite and architecture the build resolves (the security pocket and,
for cross builds, the target archive included); that contract is
documented, not enforced.

The tarball cache is keyed per mirror (a short sha prefix before the
'-buildd.tar.xz' suffix prune matches): a --mirror run over a stale
distro-default tarball would silently resolve from the distro, and
'--incremental' records must never fork across a mirror change.

The runtime source passes recognize the pinned URL as an archive
source (it carries no official host for the host-based checks): the
pocket pass and the universe pass treat it as the archive, and the
cross setup gives it every component and suite, no arch scoping (the
mirror serves every architecture by contract) and no ports entry.
'pkh test' passes no mirror: its tarballs stay distro-default.

src/main.rs

@@ -355,6 +355,8 @@ fn main() {
                 .arg(arg!(-a --arch <arch> "Target architecture").required(false))
                 .arg(arg!(-p --pocket <pocket> "Build against dependencies from a specific distribution pocket (updates, security, proposed)").required(false)
                     .long_help("Build against dependencies from a specific distribution pocket (e.g. updates, security, proposed).\nThe '<series>-<pocket>' suite will be enabled on archive sources when resolving build-dependencies."))
+                .arg(arg!(--mirror <url> "Resolve every package of the build from a specific mirror (base URL)").required(false)
+                    .long_help("Build the chroot and resolve every package from the given base URL — a caching proxy or a chosen mirror on a pinned runner — instead of the distro default: the mirror is passed to mmdebstrap at bootstrap, so the chroot tarball's apt sources carry it and every apt inside the build follows.\nThe mirror must serve every suite and architecture the build resolves: the security pocket and, for cross builds, the target architecture's archive included. PPAs and other third-party sources are left alone. The tarball cache is keyed per mirror, so pinned and unpinned builds keep separate tarballs."))
                 .arg(arg!(--ppa <ppa> "Build the package adding a specific PPA for dependencies (can be specified multiple times)")
                     .long_help("Build the package adding a specific PPA for dependencies. Can be specified multiple times.").required(false).action(clap::ArgAction::Append))
                 .arg(arg!(--inject <package> "Inject a package into the build environment (can be specified multiple times)")
@@ -1002,6 +1004,7 @@ fn main() {
                     arch,
                     series,
                     pocket,
+                    mirror: sub_matches.get_one::<String>("mirror").cloned(),
                     cwd: Some(cwd.clone()),
                     cross,
                     mode,