fix(ci): publish self-workflow feedback with exact development pins

[rldyourmnd]

Summary

Adds a self-workflow consumer for completed CI, security, fixture, maintenance and release attempts. The tool registry records the exact published development commit. Development comments must match the full ref SHA; nested action paths and container whitespace are validated correctly. Contributor guidance points to the current evidence contracts.

Closes #88.

Type of change

• Self-workflow integration and pin validation

Threat-model note

Completed-run events invoke an immutable trusted publisher; source-run code and artifacts never execute. Exact IDs flow through typed inputs. The dangerous-triggers annotation is limited to this reviewed metadata-only boundary. Issues are unassigned and do not launch agents.

Permissions diff

• Workflow: {}.
• New feedback job: actions: read for completed metadata; issues: write for bounded repository-local reports.
• No contents/deployment scopes or inherited secrets. The reusable owns its fixed hosted runner and timeout.

Validation

Core and touched validators; generated docs; actionlint; authenticated zizmor 1.26.1 (no findings, one new reviewed trigger annotation); instruction structure check. Advisory calendar checks still report four pre-existing expired facts and the unchanged Checkov image registry is stale; these are separate follow-up work.

Checklist

• Full SHA and matching release/development metadata
• Job permissions and concurrency reviewed
• No source-event expressions inside shell commands
• Self-workflow/tool registries and generated docs synchronized
• Signed Conventional Commit and DCO
• Runtime delivery is not claimed from source checks

Tier impact

• Public self-workflows
• Private consumers