deb: sync upper entries through the privileged removal path

A rootless build's upperdir entries are copy-up'd by whoever wrote
them during the build: the unprivileged build user, which host-side
is a subuid of the invoking user. The host-side sync of a forked
record removes the stale upper copy of every host-modified file, and
the plain fs removals failed with EPERM on those build-user-owned
entries: the kernel incremental run died with a bare
'Permission denied (os error 13)' and no context, ten minutes into
the run.

Route the sync removals through the privileged path (the same sudo
fallback the record teardowns use) and wrap the sync error at the
call site, so a failure names the operation instead of surfacing a
bare errno string.

src/deb/mod.rs

@@ -627,7 +627,12 @@ async fn build_binary_package_impl(
         // not drag it into the chroot.
         let mut build_resume = false;
         if let Some(s) = &session {
-            build_resume = session::sync_upper_for_resume(s, &host_tree)?;
+            build_resume = session::sync_upper_for_resume(s, &host_tree).map_err(|e| {
+                format!(
+                    "cannot sync the carried tree of the incremental build \
+                     with the host tree: {e}"
+                )
+            })?;
             if build_resume {
                 log::info!(
                     "Reusing the build artifacts of the previous attempt (incremental build)"