feat(publish): accept trusted consumer dispatch

[jmgilman]

Summary

• accept only the publish-package repository dispatch type and normalize its project and tag into the existing validation path
• force trusted consumer dispatches through protected staging and production while keeping deletion and confirmation controls out of the payload
• extend workflow policy with exact dispatch-boundary checks and negative-case proof
• publish canonical APT and RPM installation, fingerprint verification, and removal instructions

Trust boundary

The dispatch payload is untrusted until the existing project/tag registry and GitHub Release validation succeed. It cannot select staging deletion, skip staging, skip production, or provide confirmation phrases. Validation remains secrets-free; staging and production retain their protected environments and serialized publication jobs. This initial dispatch slice remains confined by the publisher to incus-gh-runner v1.0.0.

Verification

• mise exec -- actionlint .github/workflows/*.yml
• mise exec -- scripts/phase3-ci.sh
• dispatch policy positive and negative cases via validate_publish_dispatch_contract
• mise exec -- golangci-lint fmt --config .golangci.yml --diff
• mise exec -- golangci-lint run --config .golangci.yml ./... --show-stats=false
• mise exec -- go build -o bin/meigma-packages ./cmd/meigma-packages
• mise exec -- go test ./...
• mise exec -- moon run docs:build
• live key fingerprint and RPM repository URL verification against https://pkgs.meigma.dev

The end-to-end consumer dispatch proof intentionally follows after this listener is merged because GitHub handles repository_dispatch only when the workflow exists on the default branch.