fix(gds): declare both gitlink and reusable-workflow consumption

[rldyourmnd]

Summary

Declare both git-submodule and runtime-service consumption in the GDS module anchor. The GDS schema uses runtime-service for a workflow-module-consumer; declaring only git-submodule made typed consumer inventory reject valid reusable-workflow relationships. Closes #86.

Regenerated the bundle lock through GDS plan/apply/verify with the existing verified stable 0.8.0 bundle; no bundle upgrade or consumer rollout. The compiled policy output is unchanged.

Type of change

• Module metadata/provenance correction.
• One inline permission explanation so the existing pedantic audit recognizes the already-documented Docker publisher scope.

Threat-model note

No workflow behavior or permission is changed. The declaration describes how the existing product is consumed; it grants no runtime, token or repository access.

Permissions diff

None. packages: write keeps the same scope; its explanation is now inline.

Verification

• GDS repository schema validation passed.
• Canonical projection apply/verify and repeated generation (identical candidate digests) passed with stable bundle 0.8.0.
• scripts/validate_module.sh / validate_all.py --tier core: passed.
• actionlint: passed.
• Authenticated zizmor 1.26.1, pedantic, minimum low: passed (existing configured ignores/suppression unchanged).
• Diff whitespace checks passed; commits signed and DCO signed-off.

Existing examples/catalog/workflow behavior remain unchanged. No runtime fixture execution, release publication or downstream pin migration is claimed by this source-only correction.

Tier impact

Both existing public and private consumers can be modeled correctly. No billing or runner-routing change.