Add refresh decision prepare workflow

[SoundBlaster]

Motivation

P66-T20 adds a local prepare helper for generated candidate refresh decisions. Maintainers also need an auditable GitHub Actions path that produces the same evidence bundle without write credentials.

Goals

• Add a manual Refresh Decision Prepare workflow.
• Produce refresh-decision.json, prepare-report.json, and preflight-report.json as workflow artifacts.
• Keep the job read-only, workflow_dispatch-only, and non-authoritative.

Changes

• Added .github/workflows/refresh-decision-prepare.yml.
• Default inputs target the current xyflow package-set no-op comparison.
• Workflow installs SpecPM, runs prepare-refresh-decision, preflights the prepared decision, and uploads the artifact bundle.
• Updated refresh decision policy, producer bundle policy, operator guide, permissions policy, DocC, roadmap, workplan, self-spec, and workflow regression tests.

Validation

• PYTHONPATH=src pytest -q -> 260 passed
• PYTHONPATH=src ruff check .
• PYTHONPATH=src ruff format --check src tests
• git diff --check
• PYTHONPATH=src python3 -m specpm.cli validate .
• make docs-build
• make pages-smoke
• make public-index-generate PUBLIC_INDEX_OUTPUT=/tmp/specpm-p66-t21-public-index
• make dev-reload && make dev-smoke
• parsed .github/workflows/refresh-decision-prepare.yml with PyYAML and verified workflow_dispatch inputs

Boundaries and Non-Goals

• Does not run on untrusted PR events.
• Does not use repository or environment secrets.
• Does not mutate public-index/curated, public-index/generated, accepted relations, or registry metadata.
• Does not run SpecHarvester; it consumes an already available fresh generated artifact root.

Notes

• Stacked on Add refresh decision prepare helper #137 / codex/refresh-decision-prepare-helper.
• This closes P66-T21 in specs/WORKPLAN.md.