run config protect triggers after creating binary pkgs

Previously ConfigProtectInstall would be run before SavePkg/SaveDeb so
the binary pkgs would contain the config-protected file names instead of
the proper ones.