feat: publish verified x86_64 VM images

[tifycloud]

Summary

• add a browser-triggered x86_64 VM prerelease workflow pinned to the exact trusted main SHA
• build a no-key OpenWrt VM image, boot the exact artifact in QEMU, and verify LuCI plus runtime-disabled SSH
• publish exactly nine attested immutable prerelease assets
• add an independently fail-closed x86_64 VM catalog and download area to GitHub Pages
• document that VM validation does not prove Xiaomi AX9000 flashing or production readiness

Verification

• git diff --check
• Bash/Python/JavaScript syntax checks
• actionlint
• focused shellcheck
• tests/test_vm_manifest_selection.sh
• complete tests/test_static.sh
• independent final review: no P0/P1/P2 blockers

Safety boundary

This PR publishes x86_64 virtual-machine candidates only. It does not enable AX9000 factory/sysupgrade images and does not mark AX9000 as hardware-validated or production-ready.