what user/ file owner to use when creating debian packages?

The solution in the end was to use fakeroot (sudo apt-get install fakeroot).

Then the packager can own the files to be packaged, but when we run:

fakeroot dpkg-deb --build debian

it spoofs the builder to think that all the files are owned by root, and keeps lintian happy and installs the files as root on the target server.

These days you can use --root-owner-group instead of fakeroot to create a package where all files will be deployed as root.

dpkg-deb --root-owner-group --build $builddir $outputdeb