[ABI] Enforce exact staged product evidence

[brandonpayton]

Why

ABI-changing pull requests should merge only after the protected staging
pipeline proves that their exact head has current bottle and product evidence.
The projection is already available in observe mode; this change activates it
as the merge-gate commit status after all current-head checks are repeated.

This PR is intentionally parked until the ABI 43 candidate and product evidence
records have been published and independently verified. Merging it earlier
would correctly block ABI 43 rather than weakening the gate.

What changed

• Switch the required-check activation contract from observe to enforce.
• Give only the protected final validation job commit-status write authority.
• Publish merge-gate only after current request, evidence, policy, and pull
  request head revalidation all succeed.
• Add workflow mutations and Rust projection coverage for the activation.
• Regenerate the protected request-policy identity.

Validation

• scripts/dev-shell.sh ruby scripts/check-abi-staging-pr-check-workflow.rb
• scripts/dev-shell.sh bash .github/scripts/test-merge-candidate-workflows.sh
• cargo test -p xtask abi_staging::check_projection (17 passed)
• protected request-policy freshness check
• scripts/dev-shell.sh actionlint .github/workflows/abi-staging-merge-gate.yml
• git diff HEAD^ --check