ci: add CNPG artifact authority - #8

Summary

• add separately owned CNPG artifact-authority workflow
• verify signed source/runtime/rootfs proof without private registry credentials
• rebuild with exact preloaded dependency image and network disabled
• smoke-test only rebuilt local artifact with hardened runtime flags

Validation

• local authority workflow gate passed against exact dependency image ID
• signed proof and tamper rejection passed
• YAML, Bash syntax, and ShellCheck passed

Activation status

Prepared only. Non-enforcing until the sovereign-runners pool, organization required-workflow ruleset, and first remote run exist.