Makefile: document the dpkg-architecture bypass rationale

The previous commit set up -aarm64 + DEB_HOST_ARCH=arm64
without going through dpkg-architecture. Add a comment
explaining why that's safe for this particular package:
- No C compilation (only dotnet publish --runtime linux-arm64)
- dh_strip disabled (no arch-specific objcopy needed)
- dh_shlibdeps works because we install arm64 libs via multi-arch

This is the standard pattern for mono-managed / Java / Go
Debian packages that cross-build without a C toolchain.

Makefile

@@ -54,12 +54,26 @@ deb:
 	# vars set by dpkg-architecture are visible to dpkg-buildpackage.
 	# make runs each recipe line in its own shell, so we use
 	# backslash continuation to glue everything together.
-	# Direct cross-build: tell dpkg-buildpackage -aarm64 to build
-	# for arm64, and set DEB_HOST_ARCH=arm64 (and friends) in the
-	# env so debhelper rules see it. dpkg-architecture -aarm64 is
-	# NOT used because it refuses to set up the env when the CC
-	# system type doesn't match (we don't have an arm64 C
-	# compiler — we cross-publish .NET binaries only).
+	# Cross-build configuration for dpkg-buildpackage.
+	#
+	# We set DEB_HOST_ARCH=arm64 and pass -aarm64 directly to
+	# dpkg-buildpackage, bypassing dpkg-architecture.
+	#
+	# Why bypass dpkg-architecture? It's deliberately conservative:
+	# it refuses to set up the cross-build env when the C compiler
+	# (CC) doesn't match the target arch. Our package has no C
+	# code — dh_auto_build only runs \`dotnet publish --runtime
+	# linux-arm64\` (a managed-only cross-publish), and we
+	# disable dh_strip (the only rule that needed an arch-specific
+	# objcopy). dh_shlibdeps uses the multi-arch arm64 libs we
+	# apt-get install in the runner. So no arm64 toolchain is
+	# actually needed; the dpkg-architecture CC check would
+	# unnecessarily block us.
+	#
+	# We do explicitly set the four DEB_* vars dpkg-architecture
+	# would normally export (host arch, build arch, host GNU
+	# type, build GNU type) so debhelper rules see a consistent
+	# cross-build environment.
 	DPKG_HOST=$$(case "$(POSTIT_RUNTIME)" in linux-arm64) echo arm64 ;; linux-x64) echo amd64 ;; *) echo "unsupported POSTIT_RUNTIME=$(POSTIT_RUNTIME)" >&2; exit 1 ;; esac) && DEB_HOST_ARCH=$$DPKG_HOST DEB_BUILD_ARCH=amd64 DEB_HOST_GNU_TYPE=aarch64-linux-gnu DEB_BUILD_GNU_TYPE=x86_64-linux-gnu POSTIT_GIT_URL=$(POSTIT_GIT_URL) POSTIT_GIT_TAG=$(POSTIT_GIT_TAG) POSTIT_RUNTIME=$(POSTIT_RUNTIME) dpkg-buildpackage -us -uc -b -a$$DPKG_HOST
 	# dpkg-buildpackage already writes the produced .deb to
 	# /src/_src/../ = $POSTIT_OUT_DIR (its default — there's no