fix(publish): accept verified stable release versions

[jmgilman]

Summary

• generalize the existing protected publisher from the bootstrap incus-gh-runner v1.0.0 pin to registered exact stable vX.Y.Z releases
• derive package identity from the registry and package version by removing exactly one leading v from the validated tag
• reject repository-dispatch payloads containing anything beyond project and tag, and derive trusted production confirmation internally
• make Debian, Ubuntu, and Fedora clean installs assert the validated package version
• update policy regressions and operator documentation for the generalized path

Closes the protected-staging failure observed in run 29971445189 for incus-gh-runner v1.1.0.

Preserved trust boundaries

• registered projects and exact stable tags are validated before source proof and independently inside each protected publication job
• GitHub release state, asset selection, GitHub-recorded SHA-256 digests, checksum coverage, package metadata, complete architectures, and pinned-workflow provenance remain independently verified
• read-only validation still precedes protected staging, and production still depends on both validation and successful staging
• staging and production retain separate protected environments, credentials, and serialized concurrency groups
• staging remains confined to _staging/; production requires an empty prefix plus explicit production-root mode and preserves _staging/
• dispatch cannot request deletion, skip staging, supply confirmation text, choose an R2 prefix, or weaken verification
• empty-staging recovery, deletion-last synchronization, remote verification, no-op verification, signing controls, and clean installs remain intact

Version and confirmation contract

validate-request accepts only an exact vX.Y.Z tag and returns the registered package name plus package_version = tag with exactly one leading v removed. Both package formats must report that version. Manual production publication requires exactly publish <project> <tag> to production; a trusted repository dispatch synthesizes the same phrase from its already validated project and tag fields.

Validation

• PROTO_GO_VERSION=1.26.4 mise exec -- moon run root:check
• mise exec -- actionlint .github/workflows/*.yml
• mise exec -- shellcheck scripts/phase5-publish.sh
• mise exec -- python scripts/check_workflow_policy.py
• mise exec -- go test ./...
• PROJECT=incus-gh-runner TAG=v1.1.0 PROTO_GO_VERSION=1.26.4 mise exec -- moon run root:phase5-source-proof

The real source proof fetched and verified the five v1.1.0 release assets and provenance, rebuilt both package formats for both registered architectures, and clean-installed package version 1.1.0. No R2 publication or production action was performed.