Migrate NGMS to GitHub and published SwarmForge crates

[thedancingdeveloper]

Summary

• make GitHub and GHCR the canonical public source and image locations
• replace all internal/path SwarmForge dependencies with exact crates.io =0.1.0 releases and lockfile checksums
• adapt NGMS to the published SwarmForge and NZBDav APIs
• replace Woodpecker publishing with split Node B GitHub Actions jobs, keeping publish credentials isolated to the dedicated publish runner
• add a dependency/source policy check plus migration documentation
• remove an accidentally tracked nested Claude worktree and redact credential-shaped historical fixture values from the current tree

Validation

• cargo test --workspace --all-features --locked
• cargo check --workspace --all-features --locked
• cargo fmt --all -- --check
• cargo clippy --workspace --all-features --locked -- -D warnings
• python3 scripts/check_dependency_sources.py
• repository policy scan
• UI and desktop-client production builds
• mocked UI Playwright suite: 133 passed, 198 skipped
• release image build from docker/Dockerfile
• public-only test builder image build from docker/Dockerfile.test
• production Compose rendering and shell syntax checks

Follow-up boundary

This PR publishes the source/build migration. Production deployment and downstream ARR cutover remain separate planned phases. Because credentials existed in historical tracked fixtures, external credential rotation and any desired history rewrite should be handled independently from this atomic dependency migration.