ci: add manual verified M0 publisher

[Pigbibi]

Summary

• add a workflow-dispatch-only M0 publisher that verifies one explicit successful QAR weekly run, its immutable artifact, source snapshot, and hashes before delivery
• bind publisher execution to the protected m0-research-publisher Environment and QRS main
• keep QAR artifact-read and M0 publish credentials separated by step

Safety

• QAR run must be the fixed repository/workflow, main branch, successful, and schedule or workflow_dispatch triggered
• no latest-run lookup, schedule, downstream dispatch, runtime, strategy, platform, broker, or order path
• default contents permission remains read-only; output never prints URL or tokens
• required Environment branch policy and secrets are documented as a fail-closed external prerequisite

Validation

• python -m unittest tests.test_manual_m0_research_publisher_workflow tests.test_build_m0_research_publisher_envelope passed locally: 10 tests
• independent Sol audit passed
• GitHub CI will run workflow, Python, and JS checks