fix(ci): add main promotion GPU release gate

[joelteply]

Summary

• add scripts/main-promotion-gate.sh as the single canary→main per-host release receipt command
• document Mac/Metal, linux/amd64 CUDA, linux/amd64 Vulkan, and WSL2 receipt roles in docs/CARL-CI-PLAN.md
• keep native Docker publishing explicit for pre-push so canary iteration is not blocked by remote GPU host availability
• build local worker startup with the same detected Cargo GPU features used by prepush, fixing Mac Metal builds that otherwise compile without metal

Validation

• bash -n scripts/main-promotion-gate.sh src/scripts/git-prepush.sh src/workers/start-workers.sh
• scripts/main-promotion-gate.sh
• jq . .continuum/release-gate/receipts/darwin-arm64-metal-Mac-665.lan-4d628e1-20260518T180303Z.json >/dev/null
• precommit: TypeScript compilation passed; browser tests skipped because ./jtag ping/core IPC socket were not reachable
• pre-push: TypeScript clean; ESLint baseline ratchet held; Rust compile clean with --features metal,accelerate; Rust tests passed with --features metal,accelerate; native Docker publish explicitly skipped by new canary policy

Not tested

• linux/amd64 CUDA Carl receipt: requires BigMama/WSL2/Nvidia host
• linux/amd64 Vulkan Carl receipt: requires Linux AMD/Intel/Vulkan host
• full Carl install gate: use CONTINUUM_GATE_RUN_INSTALL=1 scripts/main-promotion-gate.sh on the target host