chore: complete release artifact and publication contract

[vitormattos]

Completes the LibreSign consumer configuration required by LibreCodeCoop/github-workflows#89 and #88.

• declares the production paths that must exist in the built App Store archive;
• declares development/internal paths that must not leak into the archive;
• preserves the intentionally packaged small PDF fixture instead of forbidding the whole tests tree;
• keeps package construction in the Makefile independent from the artifact contract, so ArtifactValidation can detect packaging regressions instead of sharing the same source of truth;
• configures the existing appstore-build-publish.yml workflow as the publisher observed after GitHub Release publication;
• binds the expected GitHub Release asset name to {app}-{tag}.tar.gz;
• configures the public Nextcloud App Store API used for publication verification;
• updates the release consumer validator to the immutable github-workflows commit that installs release-tool 0.9.0.

LibreCodeCoop/release-tool#11 is merged and release-tool v0.9.0 is published. LibreCodeCoop/github-workflows#98 is merged at 83fdddeb3efe9b9e464e1f5c2e2772322af94fc8.

This PR keeps consumer-specific packaging metadata in LibreSign and does not duplicate release business logic.

[vitormattos]

/backport to stable35

[vitormattos]

/backport to stable34

[vitormattos]

/backport to stable33