Promote automatic Docker Sandboxes prebuilt updates to main

[joecklau]

Summary

• promote the reviewed runtime-contract compatibility model and narrowed artifact recipe identity from develop
• enable fresh-upstream-gated automatic Act and Full candidate promotion while preserving signed provenance and explicit revocation
• retain candidate-only behavior for force-candidate runs and runtime-major transitions

Evidence

• feature PR Automate compatible Docker Sandboxes prebuilt promotion #40 was squash-merged to develop
• all feature PR checks passed across Linux, Windows, macOS, race/vet, trust rotation, core canaries, and the prebuilt publication contract
• built-in GitHub Actions token access to upstream workflow metadata was proven live
• Act and Full no-alias probes passed; Full completed both platform builds, hosted smoke checks, attestations, signing, and candidate publication
• act-latest, full-latest, and catalog-v1 remained unchanged during the probes

Main-branch behavior

After merge, the workflow may automatically advance a compatible v1 profile alias only when the corresponding upstream evidence and hosted checks are green. Catalog-first and profile-alias-last ordering remains enforced.