Correct manual-dispatch condition casing and negation analysis #272

Delivered November 1: PR #273 merged through protected checks as 07d5d6a3df4242f9b09550329f6abf22f461cd29. The exact source head and normal main contract checks and Sonar analysis passed. A fresh 97-workflow / 11-public-target main catalog passed the candidate without overlays. No live dispatch or credential exercise ran. Fork-cache enforcement remains separate in #270/#271.

The central policy's manual-dispatch evaluator can incorrectly classify a privileged job as protected. It interprets a bare negation followed by a comparison as negation of the whole comparison, and compares event-name literals case-sensitively.

For example, !github.event_name != 'push' and github.event_name == 'WORKFLOW_DISPATCH' can pass the current policy without excluding dispatch from an unprotected ref. GitHub's expression rules put negation before comparison and make string comparisons case-insensitive.

General owns a bounded parser/test correction, separate from #270/#271. Only grouped or Boolean-literal negation may establish a known result. Event literals use ASCII case-insensitive matching; unsupported terms and Unicode lookalikes remain unknown and cannot establish protection. Preserve the existing protected-ref, permissions, action-pin and publisher rules.

Acceptance:

• Reject both reported cases and their unsafe Boolean combinations.
• Preserve ordinary protected-main guards, grouped negation and safe Boolean composition.
• Add tests against the old and corrected policy and validate the current workflow catalog.
• Complete normal required CI and source review before merge.

Validation is synthetic and read-only; no workflow is dispatched by these tests.