ci: publish preview builds from fork PRs via GitHub OIDC

Splits preview publishing into an untrusted build leg and a trusted
publish leg so external contributors' PRs can be installed and reviewed.

Until now the bridge step was gated on the PR coming from this repo,
because GitHub withholds secrets from fork pull_request runs. Fork PRs
therefore got no preview build, no install instructions, and no Docker
image, which is most of the value of the preview flow for exactly the
contributions that need review most.

publish-preview.yml keeps building, but now only packs (`mode: pack`,
no network, no credentials) and uploads a workflow artifact. The new
publish-preview-register.yml triggers on it completing, runs from main
in base-repo context, and mints a GitHub Actions OIDC token that the
bridge verifies against GitHub's JWKS. No bridge secret in this repo.

The `authorize` job is the security boundary, not the label check in
the build leg: on pull_request events GitHub runs the workflow file from
the merge ref, so a PR author can edit that file to delete its own gate,
or add a workflow with a matching name to trigger the trusted leg. So
`authorize` re-resolves the PR from workflow_run.head_sha via the API,
requires it to be open against this repo and currently labeled
preview-build, and fails closed otherwise. It also supplies the PR url,
which the bridge maps to the pr-<n> dist-tag; taking that from the
artifact would let one PR retarget what VP_PR_VERSION installs for
another.

The job holding id-token does nothing but move bytes. The comment and
Docker jobs are separate jobs with their own permissions, so the job
that runs a preview package's install scripts cannot mint a publish
token.

The Docker preview stays same-repo only for now. It installs the preview
package and pushes to ghcr.io/voidzero-dev/vite-plus, and before this
change a fork could not reach it (fork runs get a read-only token, so the
push failed). Running in base-repo context is what would make it succeed,
so whether to put unreviewed fork code under the org's namespace is left
as a deliberate decision: drop the is-fork condition to enable it.

Fork builds get a warning banner naming the source fork above the
install instructions, since those lines are official-looking and end in
`curl | bash`.

Requires on the bridge side (voidzero-dev/pkg-pr-registry-bridge#86):
OIDC_AUDIENCE, OIDC_TRUSTED_WORKFLOWS, OIDC_TRUSTED_REPOSITORY_ID and
OIDC_TRUSTED_OWNER_ID set on the production Worker. The action pin here
points at that PR's head and must be repointed to a main SHA before this
merges.

Author: fengmk2