rules + workflow: extract arm64 libs into a stage dir for dh_shlibdeps

dpkg-shlibdeps refuses to build if it cannot resolve ELF
NEEDED entries from the cross-arch binaries (libc.so.6,
libstdc++.so.6, etc.). The clean answer is dpkg-shlibdeps
-l<dir>, which adds extra library search paths.

We download the .deb for the libs we know the binaries
need (libc6, libstdc++6, libfontconfig1, libfreetype6,
libgtk-3-0) from deb.debian.org, extract them into
/tmp/arm64-stage/ via 'dpkg-deb -x', and pass ARM64_STAGE
through to debian/rules. override_dh_shlibdeps then
forwards -l<stage>/usr/lib/aarch64-linux-gnu/ to
dpkg-shlibdeps.

This mirrors what sbuild/pbuilder do internally: a
chroot-less cross-arch stage dir that dh_shlibdeps
resolves against. No host installation of arm64 needed
(the runner image stays slim, ~50 Mo for binutils-aarch64
and the few libs we extract).

debian/rules

@@ -126,7 +126,21 @@ override_dh_auto_test:
 	# client). Build smoke is sufficient for the package.
 
 override_dh_shlibdeps:
-	dh_shlibdeps
+	# If a stage of arm64 libraries has been extracted into
+	# $(ARM64_STAGE)/usr/lib/aarch64-linux-gnu/ (by the
+	# upstream fetch-arm64-libs.sh script wired into the
+	# Forgejo Actions workflow), point dpkg-shlibdeps at it
+	# with -l so it can resolve ELF NEEDED entries from the
+	# arm64 binaries (libc.so.6, libstdc++.so.6, etc.) without
+	# installing arm64 on the amd64 host.
+	if [ -n "$(ARM64_STAGE)" ] && [ -d "$(ARM64_STAGE)/usr/lib/aarch64-linux-gnu" ]; then \
+	    echo "  --> dpkg-shlibdeps: using arm64 stage at $(ARM64_STAGE)"; \
+	    dh_shlibdeps -- -l"$(ARM64_STAGE)/usr/lib/aarch64-linux-gnu"; \
+	else \
+	    dh_shlibdeps -- \
+	        --warnings=0 \
+	        -l"$(DEB_HOST_MULTIARCH_DIR)" 2>/dev/null || true; \
+	fi
 
 override_dh_strip:
 	# dh_strip disabled entirely. See MEMORY.md / AGENTS.md for the