[rjd15372]

Summary

Follow-up to #142. Release mirrors have no package directories, so the
package-level qa: lanes declared in package.yaml (pg_stat_monitor,
pg_tde, ...) never reached the pre-release project and release QA would
have skipped them.

project release now appends each direct package's qa: entries to the
mirror's list as project-level entries named <package>.<segment>
(segment = the entry's name, else its pipeline), after the project's
own entries, with %!{...} macros rendered from the package's own chain
(_shared/ links followed) and ${OBS_ROOTPRJ} kept. The merged list is
validated at cut time with the same _normalise_qa_block that qa show
uses, so a duplicate or malformed entry fails the cut instead of the
pre-release QA run. On the real staging:17/18 trees this yields the
server entry plus 13 package lanes per major.

Docs: tool reference step 5 and spec §2 item 3.

Testing

620 tests (5 new), black, pyright 0 errors.