Restore dedicated public ingress monitor schedule

[cbusillo]

Summary

• remove the public ingress monitor job from Merge Train Runner
• restore the dedicated Public Ingress Monitor schedule at minute 17 and 47
• document that public ingress monitoring owns its own OIDC workflow identity

Agent review

• Antigravity recommended the dedicated schedule to preserve least-privilege workflow authz and isolate monitor failures.
• Sonnet retry agreed; the Run ingress monitor from scheduled merge train #979 403 is structural because the OIDC workflow ref changes under Merge Train Runner.

Validation

• actionlint .github/workflows/public-ingress-monitor.yml
• actionlint -ignore 'maximum number of inputs' .github/workflows/merge-train-runner.yml
• git diff --check

Refs cbusillo/code#206