[precsim]

This PR completes automatic publication of qualified upstream OCCT SDK releases and converts the default branch into an automation-only tree.

Release automation:

• .github/workflows/build-latest-occt-sdk.yml polls stable upstream OCCT daily, peels the official tag to an exact source commit, builds/qualifies the 16-file SDK candidate, and publishes only from master.
• publication creates occt-sdk-X.Y.Z at the automation revision, stages a draft release, verifies every uploaded digest, publishes, and requires GitHub to report the release immutable.
• stale drafts, prerelease/mutable matching releases, mixed source-SHA history, upstream retags, and conflicting SDK tags fail closed.
• failed-run cleanup deletes only releases it can still prove belong to the workflow attempt: drafts before publication, or an explicitly mutable publication when post-publish immutability verification fails. The lightweight tag is retained for safe retry.

Automation-only repository:

• the vendored OCCT source tree and inherited upstream CI/actions are removed from the default branch.
• retained automation checkouts sparse-check out only .github/.
• every producer separately checks out Open-Cascade-SAS/OCCT at the exact pinned source SHA.
• historical OCCT commits, branches, and SDK tags remain in Git history.

Review fixes:

• future automatic releases preserve the exact upstream source tree as opencascade-X.Y.Z-source-<sha12>.tar.gz plus an adjacent SHA-256 file.
• the source snapshot is created from the exact SOURCE_SHA during qualification, uploaded as a same-run artifact, rechecked before publication, and published alongside the 16 SDK files.
• final automatic releases therefore contain exactly 18 uploaded assets, and all 18 GitHub asset digests are verified before and after publication.
• the retained 8.0.1-r3 release template is explicitly documented as a recovery example derived from r3, not an exact historical snapshot.
• Linux/macOS producer concurrency keys include github.workflow, separating standalone producer runs from reusable calls made by the orchestrator for the same ref.
• end-to-end PR qualification now triggers for the orchestrator, all three producer workflows, their Linux/macOS/Windows helper trees, and the combined release verifier.
• post-publication immutability failure now removes only the workflow-owned release when GitHub explicitly reports it mutable, preventing a failed invariant check from leaving a public mutable release behind.

Validation:

• repository reduced from ~34,600 tracked files to 38; 34,559 obsolete files removed
• git diff --check
• YAML parse of all five live workflows plus the recovery template
• embedded Bash syntax validation for the orchestrator, including the modified publication block
• structural assertions for expanded PR path coverage and workflow-aware Linux/macOS concurrency keys
• Bash/Python/PowerShell syntax validation for all retained helpers
• canonical lean-profile consistency check passes
• git archive --format=tar.gz + SHA-256 source-snapshot smoke test passes
• no local OCCT compilation was performed