[ShutenOishi]

Fleet Issue #61: local-first safe cutover preparation

This is a staged implementation for orafce that must not produce any formal Release during CI or scheduled operation.

• Source-specific config/update-watch.json: stable-only upstream Releases and verified version-pattern matching; no prereleases or downgrade.
• config/candidate-build.json: manual-only Release policy, opt-in under authoritative central BUILD check; immutable upstream SHA and bot-owned candidate PR plus Windows CI dispatch.
• .github/workflows/update-watch.yml: UTC 00:00 schedule (09:00 JST), workflow_dispatch defaults to dry-run and trusted main workflow pushes force dry-run. Both watcher and candidate planning call pinned, fail-closed shared workflows. No candidate PR until central policy explicitly allows BUILD.
• .github/workflows/windows.yml: remove dangerous automatic release/* attested publisher, preserve five-major Windows CI and attach the reusable candidate SHA/SPDX/Grype verification to explicit candidate dispatch.
• Do not merge this PR while the central fleet lacks pgextwin/orafce. fleet-control.py intentionally fails closed for unknown repositories; central can first register the new repo as OFF without allowing watch/candidate. Central BUILD must only be enabled after all local workflows are fully tested and new operator-only publication is available.
• No automatic formal Release, no branch-protection weakening, no historic asset/tag deletion. This PR is held until replacement main-only promote.yml with explicit confirm_release=PUBLISH, source/license/attestation/PG-major guard is implemented and CI passes. This migration may temporarily block any new formal Release if merged prematurely.

See pgextwin/build#61.