Fix package-deb workflow auth and artifact flow

[Copilot]

The package-deb job was failing during the packaging reconfigure step because cmake attempted a cross-repository FetchContent clone with a token that did not have sufficient scope. The release workflow also expected a runtime .deb artifact that this pipeline never produced.

• Packaging auth

  • Use CICD_PAT as the preferred GitHub credential in package-deb, falling back to github.token only when the PAT is unavailable.
  • This aligns the reconfigure-time Git access with the broader credentials already available to the workflow.

  env:
    GITHUB_TOKEN: ${{ secrets.CICD_PAT || github.token }}

• Artifact flow

  • Remove the release-on-push download step for dls-messages-deb.
  • Keep the workflow aligned with the single artifact currently produced and uploaded by package-deb (dls-messages-dev.deb).

• Workflow hardening

  • Add explicit permissions to the workflow/jobs instead of relying on default token scopes.
  • Preserve the existing checkout safe-directory behavior for the release job.