workstation-v0 keyboard remap policy validation

[mdheller]

Adds a focused keyboard/remap policy validation tranche for the Mac-on-Linux workstation lane.

Actor:

• opened a clean branch from current main
• added check-keyboard-policy.sh
• added keyboard policy CI smoke workflow
• documented the current policy in the GNOME workstation README

Generator:

• encodes the current policy as machine-readable key=value output
• keeps input-remapper as the primary Fedora/GNOME backend
• keeps xremap as an advanced compatibility lane
• keeps Kinto as explicit X11/xkeysnail compatibility, not auto-installed in the Wayland-first profile

Critic findings and remediation:

• Finding: the first helper only exposed selected backend validity, not the canonical policy. Remediated by adding default_backend, primary_backend, compatibility_backends, wayland_first, and kinto_auto_install outputs.
• Finding: the first helper did not report whether the selected backend binary is available. Remediated by adding selected_backend_available output.
• Finding: CI did not assert template contents strongly enough. Remediated by checking left and right modifier mappings in the generated xremap template.
• Finding: policy_ok can be confused with runtime readiness. Partially remediated by documenting the distinction; follow-up should add an explicit runtime_ready output once the connector accepts the helper rewrite.

This keeps policy validation separate from future remap daemon changes.