fix(release): ship hardened libuvc capture package

[andrescera]

What

• Update CI action majors and make the release workflow trigger apt reindexing after package publication.
• Build the runtime-only package against Debian Bookworm so its libc/libjpeg ABI matches the device image.
• Ship the plugin with the pinned CeraLive libuvc ceralive-v0.0.7.8 fork and keep current-pin documentation aligned with the build.

Why

The latest published plugin package predates the libuvc lifetime/UAF fixes and the Bookworm ABI correction. The production image must consume a new package rather than reinstall v2026.6.0.

How to verify

• actionlint .github/workflows/build-check.yml .github/workflows/publish-release.yml
• bash scripts/check-source-list.sh
• bash scripts/check-libuvc-fork.sh
• cmake -S . -B build -DENABLE_SANITIZERS=OFF && cmake --build build
• ctest --test-dir build --output-on-failure
• Build the production Docker target for AMD64 and ARM64 in CI.

Risks

Real USB enumeration and device streaming remain hardware-gated. The package includes the exact pinned libuvc shared library, but the Rock 5B+ camera path must still be validated after the fresh image is flashed.