Add a Debian package and bash completion

make deb builds dist/jarl_<version>_<arch>.deb with dpkg-deb alone (no
root), for the host or another architecture (DEB_ARCH=arm64). The package
creates the jarl user and directories and an example jarl.yaml on the
first install, restarts a running jarld on upgrades, never touches
/etc/jarl/jarl.yaml, stops jarld on removal, and keeps Jarl's data even
on purge.

make install and the package install bash completion for jarl and jarld.
Besides commands and flags it completes server and group names from the
CLI configuration, zone, view, ACL, TSIG key and user names from the
server, and record types. make dist includes the completion scripts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/development.md

@@ -26,9 +26,11 @@ internal/
   acme/               ACME DNS-01 challenge records, shared by jarl acme and the httpreq endpoint
   config/             jarld's YAML configuration
 deploy/               systemd unit, sysusers.d and tmpfiles.d files
+deploy/debian/        the Debian package's control template and postinst/prerm/postrm
 contrib/acme.sh/      acme.sh DNS API hook
 contrib/lego/         program for lego's exec DNS provider
 scripts/e2e.sh        end-to-end test against a real named
+scripts/mkdeb.sh      builds the Debian package (make deb)
 ```
 
 The main flow is in `internal/engine/engine.go` (`applyOps`):
@@ -38,11 +40,44 @@ record. [concepts.md](concepts.md) describes it from the outside.
 ## Building and testing
 
 ```sh
-make            # bin/jarld, bin/jarl (CGO_ENABLED=0, version from ./VERSION)
+make            # bin/jarld, bin/jarl (CGO_ENABLED=0, version from ./VERSION),
+                # and bin/completion/{jarl,jarld} (bash completion)
 make test       # go vet, gofmt check, go test ./...
 make e2e        # scripts/e2e.sh
+make deb        # dist/jarl_<version>_<arch>.deb (DEB_ARCH=arm64 etc. cross-builds)
 ```
 
+### The Debian package
+
+`make deb` runs `scripts/mkdeb.sh`: it builds the binaries for
+`DEB_ARCH`, installs them with `make install-files` into a staging tree
+with Debian's paths (`PREFIX=/usr`, the unit in `/usr/lib/systemd/system`),
+adds `deploy/debian/{postinst,prerm,postrm}` and a `control` file filled in
+from `deploy/debian/control.in`, and packs it with `dpkg-deb
+--root-owner-group`, so no root is needed. The version comes from
+`./VERSION` (a `-` becomes `~`, so `0.2.0-rc1` sorts before `0.2.0`;
+override with `DEB_VERSION`), and the maintainer from your git name and
+email (override with `DEB_MAINTAINER`). The package ships no files in
+`/etc`: postinst writes `/etc/jarl/jarl.yaml` once, so upgrades never touch
+it.
+
+To try the package without installing it on your machine:
+
+```sh
+docker run --rm -it -v "$PWD/dist:/pkg:ro" debian:trixie \
+  sh -c 'apt-get update && apt-get install -y /pkg/jarl_*_amd64.deb && bash'
+```
+
+### Shell completion
+
+The completion scripts are generated by cobra (`jarl completion bash`).
+`cmd/jarl/complete.go` adds value completion: it reads each command's usage
+line (`add ZONE NAME TYPE DATA...`) and completes the placeholders it knows
+(`ZONE`, `VIEW`, `ACL`, `USER`, TSIG `KEY`, `TYPE`, server and group
+names), so a new command whose usage line uses these names gets completion
+without extra code. Try it without a shell:
+`jarl __complete record add ''`.
+
 ### Tests against real BIND
 
 The render, engine and adopt tests run the real `named-checkconf`,