ci: orchestrate Privacy Core with Dagger

[hseshadr]

Summary

• add a typed Dagger graph for the complete pnpm quality, 100% coverage, Chromium offline/egress proof, dependency audit, full-history secret scan, workflow lint, and exact npm release-candidate artifact
• add a pinned shadow ingress while retaining the protected legacy gates for safe cutover
• replace the artificial 24-hour registry wait and global lifecycle-script escape hatch with an explicit reviewed build allowlist
• add executable source/hosted/tarball/checksum identity contracts; publishing remains untriggered

Local evidence

• pnpm gate: 180 tests, 100% statements/branches/functions/lines, 2 Chromium proofs, strict TS/Biome/build
• .dagger: Ruff/mypy strict/Xenon A/7 tests green
• dagger call ci --commit-sha=079f871c1b2b8a6edd43971cdc5e360da47429f0: green; 56-commit Gitleaks history and exact snapshot clean; dependency audit clean
• real npm pack --ignore-scripts candidate validated: 63 public files, SHA-256 recorded

No tag, workflow dispatch, package publication, registry mutation, environment mutation, or Dependabot merge is part of this PR.