Doc: document workflow token check in contributing and mdbook

[alexhraber]

Resolves issue #1173 and fixes the release-artifact-sync workflow parse failure observed in run 31066729211.

Changes

• Documents the GitHub workflow token requirement in CONTRIBUTING.md and the mdBook.
• Adds the contributing guide to the mdBook navigation.
• Rebases and squashes the PR onto current master (v0.96.8) so its first publishable commit is complete.
• Fixes .github/workflows/release-artifact-sync.yml: the PR body heredoc was at column zero inside a YAML run: | block, so GitHub rejected the workflow before creating any jobs. The heredoc content is now indented as YAML block content while remaining column-zero in the shell script after YAML stripping.
• Makes validation refresh supported specs projections on every invocation, while release-bound entrypoints and the managed Dockerfile pin change only when the evaluating Decapod release changes.
• Refreshes those release-bound surfaces immediately after workspace creation.
• Adds a per-commit publication-bundle gate. Each publishable commit must carry the four entrypoints, managed Dockerfile, specs manifest and material spec prose, plus claims, plan, trajectory, and validation artifacts.
• Updates the agent instruction source and validation living spec so agents amend or squash before opening a PR and never stop after recoverable validation failure.

Validation

• cargo fmt --check passes.
• cargo build --bin decapod passes.
• actionlint .github/workflows/release-artifact-sync.yml passes.
• git diff --check passes.
• decapod validate --store user --format json passes locally with zero failures; warnings are limited to the existing risk-map, watcher-audit and stale-workspace review notices.
• The hosted Decapod checks are running on the rebased, single-commit head.