package-index#1: add secret-free workflow quality gate

[ksanrse]

Reviewable CI slice for #1.

• validates workflow permissions and immutable action pins;
• syntax-checks the package publication script;
• runs only without source-repo tokens or signing keys;
• documents local checks and keeps production publication out of PR CI.

Catalog extraction, fixtures, BOM integration, and publication dry-run remain follow-up criteria.

[ksanrse]

Second pass: added fixture schema/manifest/hash/Engine API/timestamp/sequence validator tests, ephemeral signing/envelope dry-run, deterministic workflow/actionlint gates, and rollback/provenance docs. Production catalog publication/signing and Windows source-package gate: NOT_RUN (intentionally).