feat: OTA updates for start-tunnel via apt repository (untested)

- Add apt repo publish script (build/apt/publish-deb.sh) for S3-hosted repo
- Add apt source config and GPG key placeholder (apt/)
- Add tunnel.update.check and tunnel.update.apply RPC endpoints
- Wire up update API in tunnel frontend (api service + mock)
- Uses systemd-run --scope to survive service restart during update

sdk/base/lib/osBindings/tunnel/TunnelUpdateResult.ts

@@ -0,0 +1,16 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type TunnelUpdateResult = {
+  /**
+   * "up-to-date", "update-available", or "updating"
+   */
+  status: string
+  /**
+   * Currently installed version
+   */
+  installed: string
+  /**
+   * Available candidate version
+   */
+  candidate: string
+}