feat: complete shared workflow platform policies

[vitormattos]

Summary

Complete the governance and architecture work from the shared-workflow roadmap.

This PR:

• adds an enforceable GitHub Actions policy check for immutable Action pins, hardened checkout and no write-all;
• adds tests and a dedicated Workflow policy CI job;
• documents the security/exception model;
• defines the dependency update and auto-merge policy;
• updates README and architecture documentation to the materialized consumer-sync model actually used in production;
• records explicit migration decisions for each evaluated workflow family, including why PHPUnit and privileged dependency automation remain consumer-local for now.

Related: #6, #11, #15, #34