ci: publish read-only runtime execution evidence

[Pigbibi]

Summary

• publish a bounded, read-only execution-evidence source after the existing report heartbeat succeeds
• reuse the existing GitHub OIDC identity and pinned QRS composite Action

Safety

• no strategy, runtime target, broker, or order path changes
• only the sanitized source snapshot reaches the control console; raw report data stays in Cloud Storage
• missing, stale, or incomplete evidence remains pending/parked

Validation

• git diff --check
• actionlint and existing CI run on GitHub.