docs: document project registration and publish operation

[jmgilman]

Summary

Follow-up to #14/#15, closing the gaps a docs-verification pass found:

Accuracy fixes (README):

• Opening paragraph still said candidates build "from fixture release sets" — fixtures were removed in chore: remove phase proofs and workflow policy checker #14.
• mise.toml tool list omitted actionlint and ShellCheck, the exact tools root:workflow-check depends on.
• MEIGMA_PACKAGES_* was described as "reserved for future configuration" — it is the live env prefix backing fetch-release (GitHub token) and apply-sync (R2 credentials).

New docs/docs/publishing.md ("Publish a release"):

• The full projects.yml contract, field by field, sourced from internal/localrepo/registry.go validation: name pattern, meigma/-only repositories, ${version} asset patterns, architecture mapping rules, retention fallback (project → default → 5), and the signer_workflow requirement.
• What the upstream release must ship: exact stable tag, checksums asset, one DEB+RPM per architecture, attestations from the pinned workflow, and package metadata matching package_name/version.
• The published-layout convention (project key = APT component = rpm/<project>/ path) and _state/manifest.json for discovery.
• How to run a publish: the real consumer dispatch mechanism (app token + gh api .../dispatches, verified against incus-gh-runner's packages.yml) and manual gh workflow run recipes for validation-only, staging-only, and full publishes.

Cross-link fixes: install.md now states the substitution rule instead of only working for the hardcoded example; operations.md no longer lists project onboarding as deferred; index/README link to the new page.

Testing

moon run docs:build (mkdocs strict mode) passes locally; gh workflow run recipes match the current publish.yml inputs.

🤖 Generated with Claude Code