ci(enactr): add native git release flows

[ctxswitch]

Summary

• add Enactr CI and protected-main flow definitions alongside the existing GitHub Actions workflows
• build and publish AMD64 and ARM64 images independently, then assemble the multi-architecture manifest
• replace removed Git storage with native Git sessions for the version-bump PR and gh-pages publication
• trigger releases from version-file pushes to protected main after the bump PR merges

Follow-up to enactr/platform#222; no separate Flywheel issue exists.

Verification

• make ci
• Documentation and examples are accurate
• New or changed behavior has test coverage

Validated all four flow files with the platform parser, semantic validator, and DAG compiler. ShellCheck passed for every embedded command. helm lint charts/flywheel --strict passed.

Operational impact

Deploy the native-Git CLI/agent image before the API begins accepting these flow definitions. Existing GitHub App installations must approve repository contents: write before the bump and Helm pushes work. The tenant still needs CODECOV_TOKEN, Docker Hub credentials, and GH_TOKEN for GitHub release creation. Rollback is removal of .enactr/; the unchanged GitHub Actions workflows remain available throughout validation.

Review notes

The native Git contract intentionally treats strings literally, so the bump flow reuses enactr/release-bump and reconciles one open PR to main. The Helm publisher owns a single gh-pages worktree and packages the exact run commit from GitHub’s source archive. Start review in .enactr/flows/bump.yaml and .enactr/flows/release.yaml.