feat: share sealed-release notifications for Homebrew and Nix - #821

Summary

Homebrew and Nix now receive the same release-completion notification through a shared matrix. Each target runs independently, supports manual retry by exact tag and channel, and reports an accepted notification separately from downstream publication. This replaces homebrew-publish.yml; PyPI and AUR retain their existing publication workflows and credentials.

The release workflow saves its verified public mcpp-release.json as a run artifact. Automatic notifications read that artifact from the completed release run and compare it with the public manifest. A release manually dispatched from main to rebuild an older tag therefore notifies the actual rebuilt version, rather than deriving a version from workflow_run.head_sha.

Closes #820.

Configuration

• Existing HOMEBREW_TAP_TOKEN remains supported for mcpp-community/homebrew-mcpp.
• Configure NIX_PUBLISH_TOKEN with Contents: write on mcpp-community/nix-mcpp to enable immediate Nix notifications.
• Missing tokens are reported as skipped; both downstream repositories retain their scheduled catch-up.
• Manual publish-packages runs require an exact stable release tag and accept all, homebrew or nix as the channel.
• Old release runs without the new artifact can be notified through the manual tag input.

Validation

• 11 new package notification tests pass, including old-tag rebuild identity, single-channel selection, invalid/incomplete manifests, missing credentials, failed dispatches and independent channel retries. Tests are wired into the CI docs job and perform no real dispatches.
• 12 release manifest tests, 18 workflow assertion tests and 7 change classifier tests pass.
• Actionlint passes for every changed workflow; workflow assertions, version pins and git diff --check pass.
• The resolver accepts the existing 2026.10.17.1 release manifest and preserves its exact tag, version and commit.
• C++ builds and runtime tests were not run locally because no C++ implementation changed; repository CI runs independently.
• No external package publication or downstream notification was performed. Cross-run artifact download and authenticated dispatch require a post-merge workflow run to verify end to end.