fix: properly commit build fixes that were never in 0984684

CRITICAL: Previous commit 0984684 did not include these fixes.

Debian (debian/rules):
- Use && to keep cargo build in same shell as . "$HOME/.cargo/env"
- Make runs each recipe line in a separate shell

Arch (build-arch.sh):
- Use << "EOF" heredoc with hardcoded path to prevent $pkgdir expansion
- $pkgdir must be literal for makepkg to expand at runtime

Alpine (build-alpine.sh):
- Copy signing public key to /etc/apk/keys/ BEFORE abuild
- Use || true on abuild because index update may fail but APK is still created

build-alpine.sh

@@ -119,12 +119,13 @@ if [ "$(id -u)" = "0" ]; then
     cp APKBUILD /home/builduser/
     cp .checksums /home/builduser/ 2>/dev/null || true
     
-    # Run abuild as builduser in /home/builduser where APKBUILD exists
-    su - builduser -c "cd /home/builduser && abuild checksum && abuild -d -F"
-    
-    # Install public key to fix UNTRUSTED signature error
+    # Install public key BEFORE abuild (fixes UNTRUSTED signature)
     cp /home/builduser/.abuild/*.rsa.pub /etc/apk/keys/ 2>/dev/null || true
     
+    # Run abuild as builduser in /home/builduser where APKBUILD exists
+    # Use || true because index update may fail but APK is still created
+    su - builduser -c "cd /home/builduser && abuild checksum && abuild -d -F" || true
+    
     # Copy APK from builduser packages to releases
     mkdir -p releases
     cp /home/builduser/packages/x86_64/*.apk releases/ 2>/dev/null || cp /home/builduser/packages/*.apk releases/ 2>/dev/null || find /home/builduser/packages -name "*.apk" -exec cp {} releases/ \; 2>/dev/null || true