fix(preview): decouple database contract gate

[xiaoland]

What changed

• split stable-Core database generation/staleness into its own Database contract job
• let Workspace contract independently verify/build the Client and upload exact Web/MF artifacts
• allow the trusted Pages preview controller to consume a failed overall PR run only when that exact run's Workspace contract job passed and its client-web-dist artifact is live
• keep production delivery gated on the entire successful Client checks workflow
• add workflow contract assertions for the new dependency graph

Why

Previewability and merge compatibility are different states. A Client PR that intentionally depends on an unmerged Core database contract can be valid to build and preview even though it is not yet compatible with stable Core and must not merge.

The old topology put type generation before the workspace build in one job. A stale stable-Core contract therefore prevented artifact creation, and Pages preview required the entire workflow to succeed. This made cross-repository feature review self-blocking.

Security and delivery boundary

• previews still require an internal same-repository PR at the exact open PR head
• the controller still runs from trusted default-branch workflow code
• the selected Workspace contract job must be completed successfully in the same workflow run
• the exact run must contain a non-expired client-web-dist artifact
• a failed workspace job cannot deploy a preview
• production delivery still requires the full workflow conclusion to be success
• Database contract remains a required merge check; branch protection must add this new context when this PR is admitted

Verification

• pnpm check — 18 files / 78 tests, all type checks and builds passed
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 .github/workflows/*.yml
• focused workflow governance tests: 6 passed
• git diff --check

Rollout

This workflow PR must land before #68 can benefit from the new preview topology. On admission, update main protection to require Database contract alongside the existing checks, then sync #68 with main and rerun Client checks.