Harden reusable workflows and introduce v1 versioning

[mtfishman]

Summary

Restructures the IntegrationTest, IntegrationTestRequest, and FormatCheck reusable workflows to reduce GitHub Actions trust-boundary risk, and introduces a versioning convention so callers can pin to @v1 instead of @main.

IntegrationTest

• Matrix expansion and the aggregation gate move into the reusable. Input changes from pkg: (scalar) to pkgs: (JSON array).
• URL-based entries are probed anonymously with git ls-remote before secrets are used. Public URLs and registered package names run normally. Private URL entries are skipped on fork pull_request events, where secrets are not in scope.
• Skipped private URL legs upload marker artifacts. The aggregate IntegrationTest gate inspects those markers and fails when every downstream leg skipped on a fork PR, with a /integrationtest <url> instruction.
• The caller-level pull_request_target: trigger is no longer needed for migrated repositories; callers should use pull_request:.

IntegrationTestRequest

• Comment-body parsing moves from direct shell interpolation to an env: mapping.
• The requested package is JSON-encoded into the new pkgs array input.
• On a successful manual run, the workflow posts a passing IntegrationTest check run for the PR head SHA, allowing a maintainer-triggered private integration test to clear the gate.

FormatCheck

• FormatCheck.yml is now the read-only parse phase. It runs on pull_request, checks out PR code without secrets, runs the formatter, uploads the diff and PR metadata as an artifact, and reports the branch-protection check.
• FormatCheckComment.yml is the trusted comment phase. It runs after the parse workflow via workflow_run, downloads the artifact, and posts or updates the format-suggestion comment without checking out PR code.
• Branch protection should require the parse-phase check (Format Check / Check Formatting); the comment workflow exists only to update the PR comment.

Hygiene Across The Rest Of The Reusables

• Direct ${{ inputs.* }} shell interpolations were moved to env: mappings in the reusable workflows.
• Explicit per-job permissions: blocks were added where they were missing.
• Mutable @latest action references in this repository were removed.

Versioning

• The README documents the vMAJOR.MINOR.PATCH release tag plus mutable vMAJOR tag convention.
• .scripts/release.sh creates release tags locally and rewrites internal @main references in the tagged commit to a fixed SHA so tagged releases are snapshot-stable.

Breaking Change

The IntegrationTest reusable input changes from pkg: to pkgs:. Per-repo callers need to update to the new JSON-array form.

Test Plan

• Open a canary PR against a public-matrix repo, pointing callers at this PR's head SHA. Verify the public downstream matrix runs and the aggregate IntegrationTest check passes.
• Open a canary PR against a Tennis-using repo. Verify internal PRs can run private URL integration tests and fork PRs require /integrationtest.
• Verify FormatCheck runs from pull_request without secrets and that FormatCheckComment posts or updates the formatting comment once the comment workflow exists on the target repository's default branch.
• Run .scripts/release.sh v1.0.0 locally after merge and confirm it creates the expected v1.0.0 and v1 tags without pushing.