ci: run the Debian QEMU e2e on push; add make target and docs

- test.yml: add a qemu-e2e-debian job (build -> boot -> LUKS-unlock in QEMU
  via the deterministic direct transport) running on push/PR, plus a
  workflow_dispatch trigger for manual runs.
- Makefile: test-qemu-debian target (LIM_E2E_OS=debian); document the direct
  vs tor transport on test-qemu.
- README: document the two build scripts and the direct transport.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Makefile

@@ -1,4 +1,4 @@
-.PHONY: install test test-tor test-qemu test-all
+.PHONY: install test test-tor test-qemu test-qemu-debian test-all
 
 PREFIX ?= $(HOME)/.local
 # Interpreter used for the tests. Override if your active venv lacks pytest,
@@ -20,11 +20,18 @@ test-tor:
 	LIM_E2E_TOR=1 $(PYTHON) -m pytest tests/e2e/test_tor_unlock_e2e.py -v
 
 # Full virtualized build+boot+unlock e2e. Needs qemu, arch-install-scripts,
-# cryptsetup, tor and ncat; the build stage runs under sudo. Set CHUTNEY_PATH
-# to use a private, offline Tor network instead of the public one.
+# cryptsetup and ssh; the build stage runs under sudo. The default "direct"
+# transport delivers the passphrase deterministically via a QEMU port-forward;
+# set LIM_E2E_TRANSPORT=tor for the full onion path (also needs tor + ncat, and
+# is flaky over public Tor inside QEMU).
 test-qemu:
 	LIM_E2E_QEMU=1 $(PYTHON) -m pytest tests/e2e/test_qemu_unlock_e2e.py -v -s
 
+# Same, but builds a Debian image with debootstrap (initramfs-tools backend)
+# instead of Arch. Needs debootstrap + cryptsetup + ssh; runs under sudo.
+test-qemu-debian:
+	LIM_E2E_QEMU=1 LIM_E2E_OS=debian $(PYTHON) -m pytest tests/e2e/test_qemu_unlock_e2e.py -v -s
+
 # Everything: mocked suite plus both opt-in e2e stages, in one run.
 test-all:
 	LIM_E2E_TOR=1 LIM_E2E_QEMU=1 $(PYTHON) -m pytest -v -s