fix: harden workflow library contracts

[jmagar]

Summary

• harden immutable action and reusable-workflow validation
• enforce runner-pool and permissions contracts consistently across library and fleet policy
• move privileged Release Please control to hosted Linux after the self-hosted lane stalled for 24h
• align Rust CI image Kache with 0.13.0 and repair stale runner/catalog documentation
• add adversarial regression coverage for validation, docs, and transport parity

Validation

• python scripts/validate.py
• actionlint
• Ruff
• ShellCheck
• python compileall
• fleet-policy regression tests
• validator regression tests
• fleet-contract tests
• workflow-library targeted tests
• git diff --check