chore: centrally manage released-mirror CI caching

[kim-em]

Closes #9373.

Summary

• add a complete centrally owned CI workflow artifact for every released mirror
• publish .github/workflows/ci.yml through the guarded release sync, including the aggregate mirror
• disable lean-action caching and explicitly restore/save root, sidecar, and published-Hex dependency build outputs only after verification completes
• keep main runs alive through their terminal cache save while retaining cancellation for superseded PR runs
• validate workflow coverage, triggers, cache paths/keys/order, helper availability, and no-matrix policy
• document the required Contents and Workflows fine-grained PAT grants and the managed boundary
• print the managed workflow diff during release dry runs

Verification

• python3 -m unittest discover -s scripts/release -p "test_*.py" (54 tests)
• python3 scripts/release/check_released_manifest.py
• python3 scripts/release/sync_released.py --dry-run --only hex-arith
• python3 scripts/release/sync_released.py --dry-run --only hex-poly-mathlib
• full release-sync dry run (all 45 targets; divergence guard preserved)
• verified every referenced scripts/ci helper in live divergent mirrors
• compared all 45 managed workflows against live mirror main; before the intended cache/concurrency changes, commands and job shapes are byte-for-byte identical
• lake build
• lake build HexConformance
• lake build hexarith_bench hexpoly_bench

[kim-em]

Fresh Claude Opus second-opinion review completed while CI was running.

Validated and addressed:

• publishing PATs need separate Workflows read/write permission for managed .github/workflows/ci.yml; docs and CLI diagnostics now say so
• caches must include released Hex dependency builds under each .lake/packages tree while still excluding Mathlib
• main runs must not be cancelled before the terminal cache save
• checker now verifies exact restore/save paths, exact restore-prefix/key relationship, triggers, concurrency, and job shape
• sync now validates referenced unmanaged scripts/ci helpers and dry runs print the workflow diff
• mutation coverage now includes pins-only CI overwrite and cache-policy failures

Not adopted: sweeping unrelated extra workflow files and broader parser/performance refactors, which are outside this issue and do not affect the managed ci.yml contract. The suggested command/job-fidelity concern was independently checked against all 45 live mirror workflows.