debian/deps: native dependency grammar and build-dep checking

Replace dpkg-checkbuilddeps with a native implementation:

- full dependency grammar: comma clauses, | alternatives, << <= = >= >>
  relations, :arch qualifiers (any/native/specific), [arch lists] and
  <profile restriction> formulas per alternative;
- restriction reduction against active build profiles and the host arch
  at parse time (reduce_restrictions semantics);
- evaluation against a parsed dpkg status database with Multi-Arch
  semantics (foreign/allowed) and versioned Provides rules (unversioned
  provides never satisfy versioned deps; versioned ones must satisfy the
  relation);
- clause simplification with implication-based deduplication, rendering
  dpkg-compatible 'unmet build dependencies/conflicts' diagnostics.

check_build_depends() consumes debian/control + CheckOpts (-A/-B/-I
equivalents). run_source_build performs the check when forced (-D
parity); source-only builds skip it entirely like dpkg-buildpackage,
and unsatisfied deps propagate as UnmetBuildDependencies -> exit 3.

Unit tests port the Dpkg_Deps.t reduction matrices; differential gate
runs 24 scenarios (alternatives, versions, arch/profile restrictions,
Multi-Arch, Provides, conflicts, -A/-B flags) against real
dpkg-checkbuilddeps comparing exit status and diagnostics.

src/main.rs

@@ -252,6 +252,13 @@ fn main() {
             let cwd = current_dir_or_exit();
             if let Err(e) = pkh::build::build_source_package(Some(&cwd)) {
                 error!("{}", e);
+                // Unmet build dependencies/conflicts exit with status 3,
+                // like dpkg-buildpackage does.
+                if e.downcast_ref::<pkh::debian::deps::UnmetBuildDependencies>()
+                    .is_some()
+                {
+                    std::process::exit(3);
+                }
                 std::process::exit(1);
             }
         }