feat(builder): merge deb-publisher + publish-docker-image into contract-driven builder skill

- skills/builder: SKILL.md, README.md, references/contract.md (make/publish
  contract v1), references/registry.md
- scripts/check.py: executable contract checker (make dry-run probes, secret
  scan, push thin-wrapper and script path checks; --build verifies real .deb)
- scripts/upload_deb.sh: migrated from deb-publisher, adds project .env
  auto-load and dirty-worktree publish gate
- scripts/publish_docker.sh: migrated from publish-docker-image publish.sh,
  now env-first (DOCKER_REGISTRY/REPOSITORY/IMAGE_TAG/PLATFORMS), refuses
  floating latest and multi-platform --load
- scripts/verify_deb.sh: metadata/content/sha256 verification with v-prefix
  normalization
- orc: deb+docker stages both route to $builder; routing table, DAGs,
  README, config untouched stage names; tests updated
- ack delivery.md + skiff source-model.md: reference builder
- remove skills/deb-publisher and skills/publish-docker-image

skills/orc/README.md

@@ -14,8 +14,7 @@ ORC 是显式调用的薄路由器：只把开发、版本发布、DEB 和 Docke
 ## 使用前准备
 
 - Orca 正在运行并启用了 orchestration。
-- 安装本次需要的 `$ack`、`$manage-release`、`$deb-publisher` 或
-  `$publish-docker-image`。
+- 安装本次需要的 `$ack`、`$manage-release` 或 `$builder`（DEB 与 Docker 共用）。
 - ORC 直接使用 skill 内共享的 `config.yaml`，不需要在每个项目初始化配置。修改这份
   配置会影响所有项目；旧的项目级 `docs/orc/config.yaml` 不再参与解析。
 - `/usr/bin/python3`；ORC v2 配置必须保持为 JSON-compatible YAML。