feat(builder): merge deb-publisher + publish-docker-image into contract-driven builder skill

- skills/builder: SKILL.md, README.md, references/contract.md (make/publish
  contract v1), references/registry.md
- scripts/check.py: executable contract checker (make dry-run probes, secret
  scan, push thin-wrapper and script path checks; --build verifies real .deb)
- scripts/upload_deb.sh: migrated from deb-publisher, adds project .env
  auto-load and dirty-worktree publish gate
- scripts/publish_docker.sh: migrated from publish-docker-image publish.sh,
  now env-first (DOCKER_REGISTRY/REPOSITORY/IMAGE_TAG/PLATFORMS), refuses
  floating latest and multi-platform --load
- scripts/verify_deb.sh: metadata/content/sha256 verification with v-prefix
  normalization
- orc: deb+docker stages both route to $builder; routing table, DAGs,
  README, config untouched stage names; tests updated
- ack delivery.md + skiff source-model.md: reference builder
- remove skills/deb-publisher and skills/publish-docker-image

tests/test_orc_skill.py

@@ -44,11 +44,11 @@ class OrcSkillTests(unittest.TestCase):
         self.assertIn("当前 shell", skill)
         self.assertNotIn("用户未指定档位时采用以下判断", skill)
         self.assertNotIn("若该档位不足以安全完成", skill)
-        for child in ("$ack", "$manage-release", "$deb-publisher", "$publish-docker-image"):
+        for child in ("$ack", "$manage-release", "$builder"):
             self.assertIn(child, routing)
 
     def test_children_do_not_reference_orc(self) -> None:
-        for child in ("ack", "manage-release", "deb-publisher", "publish-docker-image"):
+        for child in ("ack", "manage-release", "builder"):
             for path in (REPO_ROOT / "skills" / child).rglob("*"):
                 if not path.is_file() or "__pycache__" in path.parts:
                     continue