ci: publish BIND package updates safely

[bryanwieg]

What changed

• Trigger active-series package publication automatically for package-affecting master pushes.
• Validate BIND and build provenance before immutable snapshot reuse.
• Scope immutable package and source release tags to the full BIND compatibility fingerprint.
• Document automatic publication and fingerprinted rollback tags.

Root cause

A BIND-only update retained the os-bind-rp package version, so the production run reused an older immutable snapshot keyed only by that plugin version. The staged verifier then received stale BIND packages. Provenance was also validated only in the signing path, which reuse skipped.

Validation

• 283 CI helper tests passed, plus 3 subtests.
• Python helper compilation passed.
• git diff --check passed.
• Independent review found no remaining Critical or Important issues.