feat(platform): generate release-backed catalog control planes

[northcutted]

Summary

Add a release-backed source mode to generated catalog-only control planes.

This enables the ClearCutt source repository to build and release the CLI, while a separate lightweight repository—such as northcutted/clearcutt-demo—is generated by the released CLI and presents selected release evidence without copying the ClearCutt source tree or Nix implementation.

Changes

• Add inventory and github-release catalog source modes.
• Add source repository, target allowlist, and release-limit flags.
• Persist catalog source configuration in clearcutt.lock.
• Generate release-backed catalog and PR-gating workflows.
• Omit images.yaml, cli/, core/, site/, and Nix sources from release-backed repositories.
• Preserve the configurable registry-base override.
• Add structured lock validation and bootstrap convergence coverage.
• Add an offline generated-control-plane smoke test to PR gating.
• Document the two-repository architecture and reproducible demo workflow.

Validation

• go test ./...
• go vet ./...
• Go coverage: 85.1% against an 85% floor
• Generated release-control-plane smoke test
• Live catalog generation against northcutted/clearcutt release evidence
• actionlint
• Workflow-hardening validation
• Documentation command validation
• Astro typecheck
• ShellCheck and git diff --check

The live catalog validation completed with zero errors. Missing signature and vulnerability-scan evidence remains visible as expected rather than being inferred.