Can Jenkins run a shell script located outside of the Jenkins workspace

It seems that you create a binary debian package almost by hand using dpkg-deb command. While this approach is not that bad, you'll get better handling of a lot of things if you try to build packages by creating the source packages and then building binary packages out of those (even if it's architecture-independent files like PHP ones). This requires one-time configuration of several files in debian/ directory.

There is a special debian/rules file which decides what to run in order to build Debian packages of different flavors (i.e. source, binary, binary-independent) and to maintain build directory itself. You might consider running all your build tools from this file rather then invoking them one by one. To fix the problem with setting owners/permissions during the build from the unprivileged user you would need to run the whole process of building Debian packages under fakeroot wrapper. For official debian packages this can be achieved by running fakeroot debian/rules binary. However this is invoked from the dpkg-buildpackage so you just run fakeroot dpkg-buildpackage.

Debian is great by its developer tools (see packages debhelper, devscripts and related) and it appears you're not using them too(obviously because you build the packages under another operating system). They will save you a lot of time. For example, there are dh_fixperms which will fix permissions and ownership problems for you, dh_install to place files into the correct places, dh_link to create necessary symlinks and other dh_-like scripts. You might want to see how does it work in the real world, so here is a list of software implemented in PHP and packaged in Debian.

Another good tool for you will be git-buildpackage which is a wrapper for debian build tools designed to build packages maintained under Git DVCS.

You might want to look at general information for building with Git on Debian wiki page.

Unfortunately there is no phing in Debian, so you might want to ask someone to package it for Debian (so you would have your full build stack available in Debian) or just cook a Debian chroot with debootstrap and install phing manually in it.

If you're sticking to the Debian packages as a primary deployment mechanism together with some CI system here are some points:

1. Get the whole build stack into Debian, if possible. This will give you a possibility to build your software in a clean Debian chroot using tools like pbuilder or cowbuilder. Otherwise cook a Debian box for building. You might want to create a virtual machine and give it for other developers.
2. Organize a restricted Debian repository (creating GPG key for automatic signing for the repository is sufficient to reduce warnings coming from apt) and put the packages there. Add it to the target boxes' /etc/apt/sources.list.d/my-repository.list configuration file. Don't forget to import your key. This will give you information on dependencies you wouldn't have known if you installed the package with just dpkg -i *.deb until the installation phase itself.
3. You might want to install your sites from packages on some regular basis (like releases/nightly/etc) instead of installing them every build to save time and bandwith. I'm using mostly rsync and some Makefile to update database(idea borrowed from ruby database schema migration).
4. You might want to run some administrative commands from CI agent without password(for example, reloading webserver configuration when it's updated with sudo invoke-rc.d nginx reload. If so, restrict to run exact commands by modifying /etc/sudoers file respectively.

For my build (on a Linux host), I do something like this (as a build step in Jenkins) to execute a build script out of the freshly-checked-out workspace:

Execute shell Command:

 sh -x $WORKSPACE/build/myproject.build

I presume it would work similar on Windows, except of course you would use \ rather than / and you're using python rather than sh to execute your script.