ci: recover safely from target pkg repacks

[bryanwieg]

Summary

• refresh the immutable outer archive SHA-256 for the current OPNsense 26.7 pkg-2.3.1_1.pkg
• detect future OPNsense repacks after a production failure and open a review-only recovery PR
• require exact package identity plus canonical extracted paths, types, modes, ownership, flags, hardlinks, bytes, and symlink targets
• keep candidate validation read-only; repository write authority exists only in the separate PR proposal job
• rebuild the exact affected release series after a recovery PR is merged

The workflow never auto-merges a recovery. Identity or semantic-content changes remain hard failures.

Incident evidence

Production runs 35888586284 and 35890965712 stopped at the intended archive-hash gate after OPNsense repacked the archive.

Two independent downloads from the signed OPNsense 26.7 repository produced:

• identity: pkg|2.3.1_1|ports-mgmt/pkg|FreeBSD:15:amd64
• archive SHA-256: 20148990850075a716feb0b4c5fc9a603ebc7f93d30b238bac428c856c4f5fad
• embedded pkg-static SHA-256: 406774d610e27f83cbfdb30a6d711e9d4deff25cc0e67c8f08c6294649b91a36 (unchanged)

The 26.1 canonical baseline is anchored to its previously pinned archive. The old 26.7 archive was no longer available, so the new signed archive is explicitly recorded and reviewed here as the initial full-content trust baseline; this PR does not claim cryptographic old/new content equality. Future recovery proposals cannot alter that baseline.

Verification

• full CI helper suite: 308 passed, 3 subtests passed
• focused recovery/workflow suite: 46 passed
• changed bytes, identity, mode, symlink target, hardlink topology, traversal, special entries, and unavailable provenance all have rejection coverage
• independent standards/security, specification, code-simplification, and test-suite reviews: no blocking findings
• git diff --check and Python compilation pass
• prior development build completed selection, profile, tests, BIND build, plugin build, FreeBSD installation, and runtime verification; its separate prerelease upload step hit the existing immutable-release HTTP 422 issue