Add one-time public verification for the 22-factor route

[ORESoftware]

Summary

• add an explicitly marker-gated live smoke job for the initial 22-Factor publication
• fetch the public GitHub Pages endpoint from a GitHub-hosted runner
• require HTTP 200 plus the rendered title, encrypted env/enc contract, and Factor XXII anchor
• record successful verification on repository tracking issue Track ORESoftware Pages catalog and per-organization metadata #6

Safety

The job cannot run on pull requests. It runs only on a trusted push to main whose commit message contains [verify-22-factor-live]. It has read-only contents permission and issue-comment permission; it cannot publish or mutate source.

Existing publication policy

The one-time bootstrap is complete. Future publication remains restricted to annotated site-v* tags on the current main commit.

[linear-code]

DEN-3877