tests.vmTools: add a releaseTools.debBuild test

Builds GNU hello into a .deb on Debian 13 and checks that the package
holds hello and nothing from the Nix store. This covers #433008 and the
checkinstall problems behind it.

Assisted-by: Claude Code (claude-opus-5-5)

pkgs/build-support/vm/test.nix

@@ -2,6 +2,7 @@
   hello,
   patchelf,
   pcmanfm,
+  releaseTools,
   runCommand,
   stdenv,
   vmTools,
@@ -85,6 +86,23 @@ in
       ''
   );
 
+  # The .deb has to hold what `make install` installed, and nothing it merely ran.
+  buildHelloDebInDebian = releaseTools.debBuild {
+    name = "hello";
+    inherit (hello) src;
+    diskImage = diskImages.debian13x86_64;
+    diskImageFormat = "qcow2";
+    meta.description = "GNU hello, built as a .deb";
+    postInstall = ''
+      dpkg-deb --contents $out/debs/*.deb > contents
+      grep -q '\./usr/bin/hello$' contents
+      if grep '\./nix/' contents; then
+        echo "the package picked up store paths" >&2
+        exit 1
+      fi
+    '';
+  };
+
   # RPM-based distros
   testFedora42Image = makeImageTestScript diskImages.fedora42x86_64;
   testFedora43Image = makeImageTestScript diskImages.fedora43x86_64;