fogstack: add one-command local release demo

[mdheller]

Summary

Adds an executable FogStack local demo path instead of another status/documentation tranche.

This PR adds a repo-native runner that exercises the FogStack Access release path end to end:

1. bundle verification
2. validation record emission
3. manifest publication set build
4. candidate/supported promotion
5. promotion policy check
6. two-approver approval record
7. local OpenSSL approval signature verification
8. release publication gate
9. registry publication index build
10. filesystem registry publish
11. filesystem registry integrity check
12. revocation index build/check
13. registry-root metadata build/check
14. summary artifact emission

Files

• tools/run_fogstack_local_demo.py
• tools/tests/test_run_fogstack_local_demo.py
• .github/workflows/fogstack-local-demo.yml

Operator command

python3 tools/run_fogstack_local_demo.py --pack access --output-dir build/fogstack-local-demo

CI coverage

Adds FogStack Local Demo workflow. The workflow runs:

python -m pytest -q tools/tests/test_run_fogstack_local_demo.py
python3 tools/run_fogstack_local_demo.py --pack access --output-dir build/fogstack-local-demo

and uploads build/fogstack-local-demo/ as an artifact.

Non-goals

• No network registry publication.
• No production KMS/HSM signing.
• No client-side rollback runtime.
• No Office/Lattice/status-readiness mutation.
• No new repo.

Notes

This is a local filesystem demo slice only, but it turns the release/registry machinery into an operator-executable path.

[mdheller]

Merge-gate check passed.

Evidence:

• Branch is current with main: 6 commits ahead, 0 behind.
• Diff is bounded to 3 implementation files: tools/run_fogstack_local_demo.py, tools/tests/test_run_fogstack_local_demo.py, and .github/workflows/fogstack-local-demo.yml.
• All head checks are green for dc524ead3e11ffc48ccccd996719ba9ae7031cd8, including FogStack Local Demo, validate, ci, premerge-audit, platform-contracts-check, FogStack Release Proof, FogStack Wider Release Graph, and brokerage-validation.
• The new workflow proved both the pytest path and the direct operator command.

Proceeding with guarded squash merge.