Harden and finalize controlled promotion

[mayankhansraj12]

Production promotion

Promotes the trusted-event hardening and final one-way history invariant from dev.

Controls

• promotion validation executes from protected main with pull_request_target
• the policy has zero permissions and never checks out PR code
• dev stays strict and linear
• main retains release merge commits without requiring reverse synchronization
• both branches require the same core CI job

Verification

• PR Harden promotion policy execution #14 and PR Finalize one-way promotion invariants #15 passed Build, test, and package
• actionlint, YAML parsing, shell syntax, and whitespace validation passed