[ABI] Activate exact staging requests

[brandonpayton]

Why

Kandelo can derive an exact, non-endorsing ABI staging request from a pull
request head, but protected main still runs the publisher in observe mode.
The tap therefore has no immutable public request to reconcile, even though the
hosted observe path has proved the derived identity and write suppression.

Activating this one boundary lets protected tap code consume an append-only
request Release. It does not publish bottles, write to GitHub Container
Registry, promote Formulae, or endorse a candidate.

The observe canary exposed two defects in the base-owned protected classifier:
the workflow had not installed its protected Nix environment, and the dev-shell
boundary discarded its private Cargo target. Those repairs landed separately
in #1260. This PR is refreshed onto that protected base so its current hosted
run can prove the normal staging and merge-gate path.

What changed

• Switch the protected request-feed activation from observe to active.
• Require the workflow checker to retain both observe and active branches.
• Update the repository guide to describe the active request boundary and the
  still-inert tap boundary.

Validation

On the current exact merge tree I ran through scripts/dev-shell.sh:

• scripts/test-abi-staging-request-feed.sh
  • 23 request derivation/policy tests passed.
  • Immutable Release identity and collision regressions passed.
  • The request workflow checker passed.
• .github/scripts/test-classify-exact-abi-staging.sh
• .github/scripts/test-merge-candidate-workflows.sh
• scripts/check-homebrew-publish-workflow-trust.rb
• actionlint for request-feed, staging, and prepare-merge workflows
• git diff --check origin/main...HEAD

The current hosted run has already proved the repaired protected
change-scope, exact-head classification, project collection, browser smoke,
and the kernel/fork source lanes. Package staging is skipped.

Rollout boundary

After merge I will dispatch one exact request for the frozen ABI 43 head,
anonymously verify its public bytes and digest, and run tap reconciliation while
candidate publication remains disabled. Candidate packages, product evidence,
promotion, and deployment stay off until their separate protected activations
and canaries.

[github-actions]

prepare-merge: runtime/materialization tests passed against the synthetic PR merge; package staging and durable package publishing were skipped. merge-gate=success posted on PR HEAD. This PR is ready for a reviewer to squash merge.