ci: stage snapshot preservation authority - #1093

The snapshot workflow deletes prior snapshot releases and Git tags before publishing the next release. Stage the exact authority for disabling only that automatic cleanup step, preserving existing releases, assets and Git tags.

This is trust-only staging at a6e3a598db3bfb0fd9a7ab14ff95b61121f28444: only the three public-workflow presence, action and command allowlists change. They add 1 presence, 5 action and 48 command rows for future pre-release workflow context e2f8089428c6bd42d84864f9df33873a63b7e4ba4733769915f594f6027a69a4. Every existing row is retained unchanged and ordered. Workflow source is unchanged.

The separately reviewed adoption adds an unconditional false condition and two comments to the cleanup step, plus a Go regression and retention documentation. Keeping the dormant body preserves the existing policy harness's mocked cleanup/error tests. Adoption follows trusted staging integration; promotion follows adoption. Neither later phase is included here.

Validation on the unchanged prepared commits:

• Fresh independent review confirms the exact three-file scope, original-row preservation and recorded staging patch SHA256 fad00efd64ab8004555cfc9ced8f1797852effabebcc2086bc55e97ed3fd256c.
• Existing preparation evidence records 14 expected outcomes: the trusted checker accepts stage/adopt/promote and rejects combined staging/adoption, unreviewed re-enablement and premature promotion.
• The focused root Go regression passes; removal or enabling of the future guard and an additional known deletion invocation fail as expected. The unchanged snapshot mock fixtures pass.
• Future adoption actionlint reports its intentional constant-false diagnostic; it was not suppressed or reported lint-clean. No new local build, Docker or tmp-directory operations were run for publication.

Pre-release Snapshot was verified disabled_manually immediately before opening this draft, with zero queued, in-progress, requested, waiting, pending or action-required runs. Keep it disabled. This PR does not re-enable it or modify any workflow setting, credential, permission, executable pin, analyzer or policy engine. Ordinary hosted PR CI is expected. Performance comparison is deferred and unassessed, not passed.

Keep this draft unmerged pending exact-head checks and governance verification. Its three maps overlap benchmark-deferral staging PR #1091: preserve both workflows' distinct row groups when reconciling current main, and retain separate stage → adopt → promote sequencing. Do not replace complete maps with older checkpoints. No protection setting is changed or bypassed.

The future cleanup guard does not remove dormant deletion code or change normal release creation, GHCR publication, the moving snapshot image alias, or inherited --target main behavior. Re-enablement and publication remain separate decisions. No live retention or publication test has been performed, and duplicate/partial publication does not authorize deletion, replacement, force or clobber recovery.