ci: centralize trusted Coffee quality

[SonSangjoon]

Summary

• classify routine versus sensitive Coffee changes in organization-owned controls
• run all target quality checks with isolated npm authority
• require the coffee-security Environment only for protected paths or policy evolution
• isolate Eval Harbor calibration on a fresh runner with its hash-locked graph

Verification

• npm test (15/15)
• actionlint .github/workflows/*.yml
• sh -n .github/scripts/*.sh
• node --check .github/scripts/*.mjs
• git diff --check
• full central quality runner against all four target branches