Add VM smoke tests, versioned prereleases, and Pages downloads

[tifycloud]

Summary

• add pinned OpenWrt ImageBuilder VM-only images and QEMU smoke tests for x86_64 and ARM64
• publish strict versioned AX9000 RAM-test release candidates as immutable GitHub prereleases
• add a GitHub Pages downloads/configuration site backed by an immutable exact-asset release allowlist
• document release recovery, VM limitations, and browser-based operation

Safety boundary

• VM artifacts are explicitly marked NOT_AX9000_FIRMWARE=1, HARDWARE_VALIDATION=0, and NSS_VALIDATION=0
• no sysupgrade/factory image is published by the release workflow
• RAM-test releases remain prereleases and are not approved for flashing
• real AX9000 UART, recovery, reboot, Wi-Fi/NSS, storage, and stress validation remain mandatory

Validation completed locally

• actionlint .github/workflows/*.yml
• shellcheck -S warning ...
• tests/test_vm_policy.sh
• tests/test_pages_policy.sh
• tests/test_workflow_policy.sh
• NEXAWRT_FLAVOR=official scripts/validate.sh
• NEXAWRT_FLAVOR=nss scripts/validate.sh
• Python/JavaScript syntax checks
• credential-pattern scan
• independent security/release review: approved after fixes

Dynamic checks required on this PR

• x86_64 QEMU boot/network/SSH/LuCI/UCI/services/guard smoke
• ARM64 QEMU boot/network/SSH/LuCI/UCI/services/guard smoke
• normal repository policy check

Post-merge setup

• enable GitHub Pages with GitHub Actions as the source
• configure the short-lived, repository-scoped IMMUTABLE_RELEASES_READ_TOKEN secret with Administration read-only permission before creating an RC tag
• manually dispatch Pages once after enablement

No release tag is created by this PR.