Run real pinned downstream builds in CI

[jskoiz]

Summary

• Add a separate Pinned downstream builds workflow with scheduled and manual triggers.
• Run every named downstream trial through a serial matrix with a 30-minute per-trial timeout and fail-fast disabled.
• Keep the normal CI/release-evidence lane on deterministic smoke-only fixture coverage.
• Update migration documentation and trust-metadata regression tests so fixture smoke, real pinned builds, workflow bounds, and dispatcher modes stay distinct.

Refs #81

Verification

Local proof:

• cargo fmt --all --check passed.
• git diff --check and git diff --cached --check passed.
• bash -n scripts/downstream-build-trials.sh passed.
• CARGO_INCREMENTAL=0 cargo test --locked --test trust_metadata passed: 11 tests.
• CARGO_INCREMENTAL=0 cargo test --locked ran the full suite; one existing timing-sensitive DOS-scaling guard failed once, then passed when rerun in isolation.
• CARGO_INCREMENTAL=0 scripts/downstream-build-trials.sh smoke-only packaged the crate successfully in the escalated retry and began fixture compilation, but the network-dependent run was stopped before completion per the implementation handoff. Earlier attempts were blocked by local disk pressure and sandbox DNS.

Hosted state:

• Branch c1/issue-81-downstream-builds was pushed successfully.
• Hosted PR checks have not been observed yet.

Notes/Risks

• The real downstream lane is intentionally separated from pull-request and push CI; it runs on the weekly schedule or by explicit manual dispatch.
• Matrix jobs are serialized and capped at 30 minutes each, so upstream clone/registry availability can still make the lane slow or fail independently of deterministic CI.
• No hosted downstream result or merge state is claimed by this PR.