Add provenance-gated Snap edge promotion

[Hkshoonya]

Summary

• allow the reviewed Snap promotion workflow to copy the complete tested candidate build set to edge
• verify both Store artifacts against the exact release tag and GitHub-hosted provenance before changing edge
• require a dedicated SNAP_EDGE_TOKEN instead of broadening the stable or candidate credentials
• keep Store metadata publication limited to stable

Context

A connected Snapcraft/Launchpad build produced amd64 revision 186 on latest/edge after the v1.5.2 release automation merge. That Store artifact is not byte-identical to reviewed candidate revision 185 and has no GitHub attestation. Candidate revisions 185/184 and stable v1.4.0 are unaffected.

The existing stable and candidate macaroons both rejected edge release as intended. This workflow adds a narrow recovery path rather than weakening either credential.

Merge hold

Do not merge this PR until the connected Launchpad recipe has been disabled or reconfigured and a channel-scoped SNAP_EDGE_TOKEN has been added. Merging first could trigger another automatic edge build.

Verification

• 634 passed, 22 subtests passed
• 61 packaging metadata tests passed
• actionlint 1.7.12 passed
• git diff --check passed
• two live recovery attempts verified candidate revisions 185/184 and failed closed at channel authorization; neither changed Store channels

[Hkshoonya]

Security review found that the previous conditional could fall back to SNAP_TOKEN when SNAP_EDGE_TOKEN was absent. Exact head 97f6320 now guards both branches explicitly, so an edge dispatch with no dedicated edge credential resolves to an empty credential and fails before contacting the Store. The regression test rejects the unsafe fallback form; all five exact-head GitHub checks and local actionlint 1.7.12 pass.

The public Store currently has the reviewed v1.5.2 set on all three channels: amd64 revision 185 and arm64 revision 184. There is no recovery action to run now. Keep this PR in draft until the connected builder is confirmed disabled or made non-publishing and a genuinely edge-scoped SNAP_EDGE_TOKEN exists. Do not reuse or broaden the stable credential.