fix(publish): match allowed filenames case-insensitively

[FenjuFu]

Summary

• Normalize both configured allowlist entries and package paths with Locale.ROOT before matching.
• Add a regression test covering a conventionally capitalized Makefile.
• Restore CLI/API publishing for packages whose explicitly allowed filenames contain uppercase letters.

Validation

• Backend tests passed
• Frontend typecheck and lint passed
• OpenAPI contract unchanged; regeneration not applicable
• Staging smoke test not run (Docker is unavailable on this machine; no API or operator workflow changed)

Commands run:

.\mvnw.cmd -pl skillhub-domain -am "-Dtest=SkillPackageValidatorTest" "-Dsurefire.failIfNoSpecifiedTests=false" test
# 21 tests, 0 failures

.\mvnw.cmd -pl skillhub-domain -am test
# 443 domain + 21 storage tests, 0 failures

pnpm run typecheck
pnpm run lint

The repository's full skillhub-app dependency-suite command was also attempted. The local executor timed out after six minutes while it was still progressing (97 Surefire reports generated, no failures observed); GitHub CI remains the authoritative full-suite run.

Risk

• User-facing impact: explicitly allowed filenames now match case-insensitively as intended.
• Deployment or migration impact: none.
• Rollback approach: revert the single commit.

Notes

• Closes [Bug] 上传扩展名白名单无法匹配含大写字母的文件名（Makefile/Dockerfile/CODEOWNERS） #766
• No API shape, authentication, namespace routing, or documentation contract changed.