feat(ci): publish Scoop manifests after releases

[jmgilman]

Summary

• add a default-off reusable Scoop publisher that verifies the release artifact and signed bundle before minting a bucket-scoped App token
• carry Scoop controls through the Actions artifact while excluding both package-manager controls from signed/public GitHub Release payloads
• run Scoop and Homebrew publication independently after the public GitHub Release and document the workflow, credential, output, and control-file contracts

Verification

• actionlint on all five changed workflows, ignoring only the repository's established $/.github/actions/setup-release-cli parser limitation and pre-existing ShellCheck notices
• mise exec -- goreleaser check
• mise exec -- moon run root:check
• structural YAML assertions for disabled credentials, job ordering, permissions, dependencies, output states, and control isolation
• GoReleaser snapshot produced exactly one Homebrew cask and one Scoop manifest; both Windows archive hashes matched the generated manifest