chore: add managed Bark qualification workflow

[orangeshyguy21]

New Features

• Managed Bark qualification — a new CI workflow restores retained native Bark images (server, processor, CLN hold) on a clean runner. It verifies checksums, provenance and offline probes, then runs the bark-processor acceptance gate. It is dispatchable from component-images.yml with family=bark-qualification.
• Bark xtask commands — bark-restore, bark-stage and bark-evidence handle restoring, staging and recording qualification evidence.
• Acceptance cache inputs — proofstorm-acceptance --image-cache-inputs bark-processor prints the exact images the gate needs, without creating a runtime.

Changes

• Platform-keyed Bark image pins — the Bark catalog reads its image digests from an embedded bark_images.json. Qualification can stage verified amd64 or arm64 images. Platforms with no entry stay out of the catalog.
• Component images workflow — adds a candidate_run input and a read-only actions permission. Concurrency is now scoped per family and architecture, and only pull requests auto-cancel.
• Release docs — new scripts/BARK-RELEASING.md covers qualification and the publication handoff. RELEASING.md now points to it.

Note

Green Checks do not qualify or publish the Bark images. Run the separate Bark handoff before a release that distributes them.

Testing

• scripts/test-bark-qualification.sh is added and wired into scripts/check.sh, along with its shellcheck coverage.
• New xtask unit tests cover the Bark restore and stage logic.