chore: make orchestrator dispatch only

[mnkiefer]

• Unification and simplification of how campaign scope is defined and enforced across campaign specs, orchestrator instructions, and related documentation.
• Main change is the consolidation of repository and organization scoping fields (allowed-repos, allowed-orgs, discovery-repos) into a single scope field, along with clarifications to orchestrator and worker responsibilities regarding project writes and workflow dispatching.

[mnkiefer]

@copilot recompile and fix tests

[Copilot]

@mnkiefer I've opened a new pull request, #11867, to work on those changes. Once the pull request is ready, I'll request review from you.

[mnkiefer]

@copilot recompile campaign workflow

[Copilot]

@mnkiefer I've opened a new pull request, #11875, to work on those changes. Once the pull request is ready, I'll request review from you.