ci: add opt-in fork-friendly release ops (signing, publishing, fork sync)

[arcaven]

Offers back the release-ops pipeline the ArcavenAE fork has been running in production since 2026-07-15. Everything is inert by default: with no repository variables set, every job either skips at scheduling time or never triggers, and CI is unaffected — no Apple Developer account, secrets, or tap repo are required to host these files. The design is ported from jira-cli's fork-friendly release-ops (docs/specs/fork-friendly-release-ops.md there), where the same pattern already lives upstream.

What this adds

File	Purpose	Inert unless
.github/workflows/sign-and-publish.yml	Sign + notarize macOS binaries on five channels (develop push → wirerust-a, v*-dev.* → wirerust-d, v*-beta.* → wirerust-b, v*-rc.* → wirerust-rc, stable v* → wirerust), publish to a Homebrew tap	vars.SIGNING_ENABLED == 'true' (+ vars.HOMEBREW_TAP_REPO for tap jobs)
.github/workflows/backfill-release.yml	Build + release an existing tag that has no GitHub Release; optional sign/publish	manual workflow_dispatch only; sign/tap jobs var-gated
.github/workflows/sync-upstream.yml	Scheduled fork→upstream merge (main/develop/factory-artifacts) with protected-file auto-resolution	vars.SYNC_UPSTREAM_REPO set (forks only)
.github/workflows/signing-guard.yml	Actively runs on PRs/pushes touching workflows: YAML-structure-aware CWE-77 scanner for inline ${{ }} expansions in secret-bearing jobs (scripts/check-signing-workflow-injection.sh, includes --self-test negative fixture)	n/a — read-only lint, no secrets, python3+PyYAML are runner-preinstalled
.github/local-workflows.txt	Registry of files the fork sync auto-resolves "ours" on conflict	read only by sync-upstream
Formula/wirerust{,-a,-b,-d,-rc}.rb	Homebrew formula templates (placeholders sed'd at publish); parallel channel installs (wirerust + wirerust-a coexist)	read only by the publish jobs
packaging/Info.plist, scripts/create-{app,dmg,pkg}.sh	macOS .app/.dmg/.pkg packaging helpers	invoked only by sign jobs

Notes for review

• All uses: are 40-char SHA-pinned and pass the existing action-pin gate. dtolnay/rust-toolchain is pinned to a master SHA with an explicit toolchain: stable input rather than a versioned-branch snapshot — the versioned-branch SHAs hardcode their toolchain and silently ignore the toolchain: input (we hit this live: two failed runs before the fix; wirerust needs 1.91 and has no rust-toolchain.toml to mask it, since this repo intentionally tracks rolling stable).
• Security posture: run-blocks in secret-bearing jobs env-bind all context expressions (CWE-77), alpha tags are reserved atomically via the GitHub API (no TOCTOU), verification steps use set -eo pipefail + mktemp/trap. The signing-guard workflow enforces the env-binding rule structurally and fails closed.
• Bundle identifier is com.arcavenae.wirerust in packaging/Info.plist + create-pkg.sh — per the jira-cli convention this reflects the first signing fork; a different signing fork overrides it to match its own Apple team. Happy to change if you'd prefer a placeholder.
• Formula descriptions stay ≤ 80 chars including channel suffixes (Homebrew's brew audit desc cap); the templates carry the audit rules as comments.
• The CHANGELOG gate is untouched: this PR modifies only .github/, Formula/, packaging/, scripts/.

Verified in production (ArcavenAE/wirerust)

• Alpha channel: signed + notarized + stapled binaries/pkg/dmg published, brew install arcavenae/tap/wirerust-a verified (Developer ID chain + hardened runtime).
• Stable channel: v0.12.1 backfilled, signed, brew install arcavenae/tap/wirerust verified; parallel install with wirerust-a confirmed.
• Sync: scheduled merges green across main/develop/factory-artifacts.

If merged as-is, the fork and upstream copies are byte-identical, so future scheduled syncs remain conflict-free and the local-workflows.txt entries become pure insurance. mise users also get mise use github:Zious11/wirerust@latest for free from the release assets.