feat(packaging): bundle SRT sample tools into libsrt1.5-ceralive

[andrescera]

What

Ship the SRT sample command-line tools inside the existing libsrt1.5-ceralive
runtime package. packaging/build-deb.sh now builds with -DENABLE_APPS=ON, so
/usr/bin/srt-live-transmit (plus srt-file-transmit and srt-tunnel) land in
the package. No new package, no new release/dispatch plumbing.

Why

The device path needs a first-party srt-live-transmit (SRT↔UDP relay). Today the
only first-party SRT artifact is the shared library, and build-deb.sh forced
-DENABLE_APPS=OFF, so srt-live-transmit was never built or published anywhere.

A separate srt-tools-ceralive package is impractical from this repo alone: the
apt reindex (apt-worker/scripts/reindex.sh) downloads every .deb in a release
tag and hard-fails if any package name differs from the dispatched component, and
its allowlist has no tools package — so a separate package would require an
apt-worker change plus an image-pipeline entry. Bundling keeps the whole change
inside srt and reuses the existing libsrt1.5-ceralive component, release, and
apt-reindex dispatch unchanged. The package already shipped /usr/bin/srt-ffplay
and dev headers, so it was never a pure shared-object package.

How to verify

Local (Docker debian:bookworm, amd64) — all green:

• DEB_ARCH=amd64 packaging/build-deb.sh builds the library + the three tools.
• packaging/package-contract.sh passes (now also asserts ENABLE_APPS=ON +
  ENABLE_STATIC=OFF).
• packaging/verify-runtime-replacement.sh <deb> passes: Debian libsrt1.5-gnutls
  is replaced, GStreamer's libgstsrt.so resolves libsrt-gnutls.so.1.5, and the
  installed srt-live-transmit ldd resolves the same libsrt.so.1.5 with no
  libssl/libcrypto.
• srt-live-transmit runs and reports Built with SRT Library version: 1.5.5.
• objdump -p srt-live-transmit NEEDED = libsrt.so.1.5, libstdc++.so.6,
  libgcc_s.so.1, libc.so.6 — no OpenSSL, no second libsrt.

CI: runtime-package.yml exercises the packaging change on this PR.

Risks

• Single-fork invariant: preserved. -DENABLE_STATIC=OFF means the tools
  dynamically link the same shared libsrt.so.1.5 shipped here (GnuTLS via
  USE_ENCLIB=gnutls); no OpenSSL and no second libsrt are introduced.
  package-contract.sh locks ENABLE_APPS=ON + ENABLE_STATIC=OFF, and both the
  release workflow and verify-runtime-replacement.sh assert the no-OpenSSL /
  correct-libsrt linkage so this can't regress silently.
• Package size: grows by ~1 MB (three small binaries). No new runtime
  dependencies (the tools need only libsrt, libstdc++, libc).
• File-path collisions with Debian srt-tools: none in practice — Debian
  srt-tools depends on libsrt1.5-gnutls, which this package already
  Conflicts/Replaces/Provides, so apt won't co-install them on the device.