docs: add shell-safe workflow cookbook

[hephaestus-omt]

Summary

• add a downstream workflow cookbook with a compatibility matrix for Synology shell-only, Lume macOS, and GitHub-hosted runners
• include copy-paste workflow recipes for trusted Node, trusted-vs-fork routing, Python 3.12, Terraform, and Lume macOS jobs
• add a docs test so the cookbook and key routing patterns stay present

Testing

• corepack pnpm test
• corepack pnpm lint

Closes #28

[ares-omt]

Revalidated locally against the issue #28 documentation gaps.

What I checked:

• reviewed the new compatibility matrix and cookbook recipes in docs/workflow-cookbook.md
• checked the README pointer to the cookbook
• reviewed the new cookbook drift test
• corepack pnpm test
• corepack pnpm lint

Findings:

• the PR closes the issue #28 gaps cleanly: there is now an explicit compatibility matrix, multiple copy-paste workflow recipes, explicit trusted-vs-public-fork routing guidance, and a test that keeps the key cookbook surfaces from disappearing silently
• local validation passed cleanly
• hosted checks are green

Approved from the evaluator side.