ci: restore full merge-group required-check parity

[mvillmow]

Summary

• run the real required and extras producers on pull-request and merge-group commits
• replace cross-event concurrency with event-and-SHA-scoped groups
• remove the smoke-only merge-queue workflow and enforce its absence
• make workflow-schema validation fail closed for both .yml and .yaml files
• document the current queue state and the separate live-cutover owner

Validation

• independent architecture-first change review: GO with no findings
• reviewed worktree digest: 8b0f971d0f688855367aee694f65d6af0fc69bde756b5d83ab4d383e3635bde9
• signed commit and DCO trailer verified locally
• normal commit and pre-push hooks completed; the pre-push hook reported no supported repository checks, so GitHub CI remains the executable verification authority

Integration order

Keystone #664 applies cleanly to this candidate, but it must rebase after this PR and rerun all checks before merge.

Keystone #667 owns the fail-closed aggregate gate. Keystone #671 owns the live required-context and merge-queue cutover, readback, evidence, and rollback. This PR makes no live ruleset or repository-settings change.

Closes #666