ci: publish merged release-source changes

[bryanwieg]

Summary

• trigger production publication when a package-affecting PR is merged into release/bind-rp/<series>
• pin release source to the merged commit and CI control code to the trusted workflow commit on master
• skip closed, unmerged PRs and preserve existing master-push/manual behavior
• document the automatic build contract

Verification

• python3 -m pytest -q .github/ci/ci-tests (296 passed, 3 subtests passed)
• focused workflow tests (22 passed)
• git diff --check
• independent standards, spec, code-simplification, test-suite, and documentation reviews: no findings

Manual build of the shutdown fix

Production run 35888586284 was triggered for series 26.7. Selection, profile, and all CI helper tests passed. The BIND materialization job stopped at the existing provenance gate because the current upstream target pkg archive SHA-256 no longer matches .resolver-plugins/target-pkg.json; no artifacts were published.