ci: validate signed fork contributions

[ddurst-nvidia]

Pull Request

Why

• Let maintainers validate signed contributions directly from contributor fork
  heads while retaining protected-main workflow authority.

What changed

• Require every human-authored pull-request commit to be linear, GitHub
  Verified, and signed off by its exact Git author.
• Remove the same-repository adoption requirement while preserving the strict
  release App identity path.
• Add a path-bound, GitHub-hosted Linux, macOS, and Windows supplement that runs
  the exact candidate cargo xtask ci when validation code or configuration
  changes.
• Preserve exact PR/head identity in protected validation run titles and exact
  PR/comment identity in command-receiver titles so reconciliation and delayed
  event diagnosis remain unambiguous.
• Document that /ok to test <sha> authorizes testing, not integration.

Review guide

• Start with .github/scripts/protected_pr_ci.py, then review the
  candidate_ci job and its required/skip regressions.

Compatibility impact

• None. This changes pull-request validation policy only.

Dependency and licensing impact

• No runtime, package, or published-crate dependency changes. The supplemental
  job provisions the existing validators plus cargo-deny 0.20.2 ephemerally.

Related issue

• None.

Testing

• cargo xtask ci — passed.
• actionlint 1.7.12 with .github/actionlint.yaml — passed.
• shuck check .github/scripts — passed.
• Python compilation and 64 protected-controller regressions — passed.
• rumdl check CONTRIBUTING.md .github/pull_request_template.md — passed.
• git diff --check — passed.
• Shared controller, controller tests, archive validation, and commit-policy
  parity with yaml-sigil-traits — passed.

Checklist

• I confirmed this belongs in the Rust implementation repository and is
  not a language-neutral specification change better handled in
  yaml-sigil-spec.
• I confirmed this change does not bypass or conflict with the public API
  contract in
  yaml-sigil-traits; any required
  traits changes are already available or tracked as coordinated work.
• I have the right to submit this contribution, every commit is GitHub
  Verified, and every commit includes a Signed-off-by trailer that exactly
  matches its Git author.
• I understand and can explain this change.
• I updated documentation or tests where needed.
• I reviewed CONTRIBUTING.md and SECURITY.md.

[ddurst-nvidia]

/ok to test 3f71017

[ddurst-nvidia]

/ok to test 98707c2

[ddurst-nvidia]

/ok to test 1a14934