* ci: speed up Plasma validation and editorial checks

Use a validated minimal Ubuntu/Neon toolchain and preserve required coverage gates. Document image maintenance, runtime selection, and per-scenario timing; parity TODO and user requirements are unaffected.

* ci: publish the labelled amd64 runtime manifest

Keep the validated toolchain unchanged while bootstrapping GHCR with its source-labelled platform image. Document single-platform publication and update both runtime pins and security checks.

* ci: bootstrap the repository-owned runtime package

Temporarily dispatch the validated image publisher on this trusted branch so GITHUB_TOKEN creates the package with repository access. Remove this bootstrap trigger before delivery.

* ci: consume the validated repository-owned toolchain

Pin the successfully validated Actions-published image and remove the temporary bootstrap trigger. Document verified repository-token access instead of assuming CLI labels grant it.