feat(ci): add Sentry and package action facades

[tcballard]

Summary

• add Sentry as the sixth As Decided CI capability
• run native decided sentry in diff or full-tree mode and upload SARIF
• remove Herald's Python runtime and delegate rendering to native decided herald
• package six deterministic distribution facades from the authoritative monorepo
• give the five shipped GitHub Actions root action.yml manifests for Marketplace repositories
• retain Recordkeeper as an explicitly non-Marketplace-ready facade until its execution wrapper exists
• update public action names and defaults from RAC to As Decided / decisions
• default native actions to Core v0.24.0, with verified checksums for Linux, Apple Silicon macOS, and Windows
• retain verified installation support for workflows explicitly pinned to Core v0.23.1

Dependencies

• feat(spec): define deterministic code constraints spec#6 (merged)
• feat(engine): add Sentry enforcement and native Herald rendering core#387 (merged)
• Core v0.24.0 (published; all native release jobs passed)

Validation

• 23 action and packaging tests pass
• bash -n shared/install-native.sh scripts/package-facades.sh
• generated all six facades and verified root action manifests/installer paths
• downloaded and SHA-256 verified all three Core v0.24.0 native archives
• confirmed each archive contains decided and decided-mcp
• smoke-tested the release artifact on macOS: decided 0.24.0 and decided sentry --help
• git diff --check

Marketplace publication is intentionally not part of this PR; we can review each generated facade together after merge.