feat(releases): ingest verified GitHub packages

[jmgilman]

Summary

• register the real meigma/incus-gh-runner release contract, architectures, retention, and trusted signer workflow
• add atomic GitHub Release discovery with stable-release checks, GitHub asset digest verification, and pinned-workflow SLSA provenance verification
• extend deterministic candidate rebuilds to generate and verify both amd64/arm64 APT indexes and x86_64/aarch64 RPM trees
• add an opt-in real-source proof for v1.0.0 that performs clean DEB and RPM installs without publishing

Trust boundary

The source path is read-only toward GitHub and R2. It rejects unregistered projects, draft/prerelease tags, incomplete asset sets, unexpected asset API URLs, missing or mismatched GitHub digests, unregistered package metadata, and provenance outside the configured tag workflow. Verified downloads become visible atomically. This PR adds no privileged workflow, production R2 apply, consumer dispatch, or production credentials.

Verification

• mise exec -- golangci-lint fmt --config .golangci.yml --diff
• mise exec -- golangci-lint run --config .golangci.yml ./... --show-stats=false
• mise exec -- go test ./...
• mise exec -- go build -o bin/meigma-packages ./cmd/meigma-packages
• mise exec -- scripts/phase3-ci.sh
• mise exec -- sh -c 'cd docs && uv sync --locked && uv run --locked mkdocs build --strict'
• mise exec -- moon run root:phase1-proof root:phase2-proof
• moon run root:phase5-source-proof

The real-source proof downloaded the public v1.0.0 release, verified all four package attestations, generated both repository architectures, and completed clean native Debian and Fedora installs.