ci: two-tier CI + gating Linux dist build + rolling edge prerelease

[RobbieMcKinstry]

Modernize the GitHub Actions setup to match the current Wack pattern
(keystore/aviary/hare/metricstore), adapted for a binary (cargo-dist)
release instead of a Helm/Docker release.

on-push.yml (fast tier)

• Run only format + clippy instead of the full cargo make ci-flow,
  for fast PR feedback. Inline jobs on wack/gh-actions/setup-rust@trunk,
  replacing the monolithic validate.yml reusable workflow.
• Exclude gh-readonly-queue/** from push triggers so on-push's fast
  "⚡ PR Ready" can't satisfy the merge queue's required check before
  on-merge's comprehensive one finishes.

on-merge.yml (comprehensive tier)

• format + build (cargo make ci-flow, which already bundles
  coverage) gate the merge queue.
• Add a gating cross-platform release build: dist-plan reads the build
  matrix from dist plan at runtime (so it tracks dist-workspace.toml),
  filtered to Linux targets; dist-build builds all Linux dist targets
  on every merge candidate. macOS builds stay on tags (release.yml) to
  keep 10x-billed macOS runner spend off the merge queue.
• Add publish-edge: runs last in the merge group (after format, build,
  and dist-build are green), reuses the validated dist-build artifacts,
  and force-updates a rolling edge prerelease pointed at the candidate
  commit. It gates the merge (in pr-ready's needs) with retry on the
  release upload. edge carries Linux binaries; macOS ships with tags.

release.yml / dist

• Bump cargo-dist 0.29.0 -> 0.32.0 and regenerate release.yml
  (checkout@v6, upload-artifact@v7, download-artifact@v8, attest@v4).

No CROSS_REPO_PAT is configured: multitool's only git dependency
(multitool-rust-sdk) is public. The dev-only Dockerfile is removed; it
was never published and nothing referenced it.

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

[RobbieMcKinstry]

• ci: two-tier CI + gating Linux dist build + rolling edge prerelease #141 👈 (View in Graphite)
• trunk

This stack of pull requests is managed by Graphite. Learn more about stacking.