[CI] Reserve publisher integration for policy changes

[brandonpayton]

Why

Ordinary package and runtime pull requests currently pay about 17 minutes to
exercise the complete privileged Homebrew publication lifecycle. When those
changes do not touch publisher policy, that suite does not test the code that
changed and delays the next useful staging result.

This is especially costly while ABI 43 is iterating through candidate bottle
waves. The publisher suite remains valuable when its own policy changes, but it
should not be a tax on every unrelated iteration.

What changed

• Gate the publisher-only host sealing, pinned Homebrew checkout, JavaScript
  install, and complete publisher suite on the existing fail-closed
  package_publish_flow_changed scope.
• Keep the full suite for publisher-only and mixed publisher-policy changes.
• Keep reusable publication jobs unconditionally sealed.
• Extend the workflow contracts with unconditional and wrong-condition
  mutations.

No Formula, package, ABI, request, candidate, bottle, or publication digest is
changed. This PR is separate from the immutable ABI 43 request.

Validation

• Publisher lifecycle source contract: pass.
• Publisher workflow trust checker: pass.
• Homebrew change-scope contract: pass.
• Ruby syntax checks: pass.
• actionlint -ignore SC1007 .github/workflows/staging-build.yml: pass.
• git diff --check: pass.

Unfiltered actionlint still reports the pre-existing SC1007 warning at
staging-build.yml:1266; the same warning reproduces against origin/main.

Because this PR changes publisher-flow policy, its hosted staging preflight is
expected to run the complete publisher suite once. That hosted result is the
integration gate before merge.