feat(publish): add protected production publication

[jmgilman]

Summary

• add an explicit production-root R2 apply mode that preserves the reserved _staging/ namespace and rejects incomplete candidates before remote access
• publish the verified incus-gh-runner v1.0.0 release through protected staging and production jobs with exact confirmation phrases and separate credentials
• assign immutable cache metadata only to package payloads and content-addressed metadata, while staging and mutable activation objects remain no-store
• add an opt-in staging-only empty-and-rebuild recovery rehearsal plus clean Debian, Ubuntu, and Fedora install verification

Safety boundary

• production runs only after read-only validation and protected staging succeed
• production requires an empty prefix and cannot mutate or verify _staging/
• empty recovery exists only for _staging/; there is no production-empty operator input
• this initial slice accepts only incus-gh-runner v1.0.0
• signing uses the CI subkey, never the primary-key backup

Verification

• mise exec -- env PROTO_GO_VERSION=1.26.4 moon run root:check --force
• mise exec -- env PROTO_GO_VERSION=1.26.4 moon run root:phase5-source-proof --force
• mise exec -- actionlint .github/workflows/publish.yml
• mise exec -- shellcheck scripts/phase5-publish.sh scripts/phase5-source.sh scripts/phase4-staging.sh
• mise exec -- python scripts/check_workflow_policy.py
• mise exec -- go test ./internal/r2repo ./internal/cli

[jmgilman]

Protected staging recovery rehearsal passed on exact PR head 64dd7630b8e4b94cf08f72e19417e31f9a7648fa.

• workflow run #29888006129 passed the read-only real-release proof
• staging emptied only _staging/, then rebuilt from verified incus-gh-runner v1.0.0 assets
• 27 ordered R2 actions applied; remote rehydration/verification passed
• the repeat publish was a verified zero-action no-op
• clean Debian 13, Ubuntu 26.04, and Fedora 44 installs passed
• the public staging manifest now selects v1.0.0 with four packages
• production was disabled and skipped
• the temporary feature-branch staging deployment policy was removed after the run