ci: decouple live E2E qualification from managed-image publication

## Problem

`.github/workflows/managed-images.yaml` currently runs substantial live runtime qualification after managed images have already been built, validated, published, and recorded:

- `PR exact all-agent managed runtime activation`
- `PR exact OpenClaw managed-image MCP discovery (pass 1)`
- `PR exact OpenClaw managed-image MCP discovery (pass 2)`

These are real E2E suites. The activation job launches OpenShell/Docker sandboxes and onboards all shipped agents. Each MCP job runs the full OpenClaw MCP bridge lifecycle, including discovery, invocation, credential rotation, restart, rebuild, removal, policy denial, and artifact secret scanning.

They consume the exact managed-image cohort, but they do not build, publish, validate, or produce those images.

The manual PR E2E resolver currently requires the entire managed-image workflow for an exact PR head to conclude successfully before it will reuse the published cohort. As a result, an unrelated runtime E2E failure makes a successfully published image cohort unavailable to every other selective E2E.

This coupling was visible in PR #11792 and managed-image run 34987776213: the exact images and direct startup checks succeeded, but activation/MCP failures prevented the lifecycle E2E workflow from consuming those valid images.

## Why this is wrong

Image publication and runtime qualification have different ownership and failure semantics:

- Image publication should establish immutable image identity, provenance, contract validity, direct startup, and publication receipts.
- Live behavioral qualification should consume those receipts downstream in the E2E workflow.
- One behavioral suite must not invalidate the existence or reuse of an otherwise valid exact-head image cohort.

The current structure also serializes unrelated E2E behind lengthy MCP runs and makes image-preparation failures misleading.

## Proposed change

1. Remove the all-agent activation and two MCP discovery jobs from `managed-images.yaml`.
2. Run them from the normal E2E workflow or another downstream runtime-qualification workflow.
3. Make the managed-image publication boundary emit a reusable exact-head cohort receipt once the image build, contract validation, direct-start validation, and publication jobs pass.
4. Make downstream E2E consume that immutable receipt by exact repository, revision, release, cohort, platform, digest, and producer identity.
5. Keep activation and MCP qualification independently visible and independently enforceable where appropriate; do not weaken their test assertions or credential protections.

## Acceptance criteria

- [ ] `managed-images.yaml` no longer runs the live all-agent activation suite.
- [ ] `managed-images.yaml` no longer runs either live OpenClaw MCP discovery pass.
- [ ] Those suites remain available as downstream E2E targets/jobs.
- [ ] A successfully published exact-head managed-image cohort can be reused by selective PR E2E without waiting for unrelated runtime qualification jobs.
- [ ] Failure of activation or MCP qualification does not classify image publication itself as failed.
- [ ] Exact-head, same-repository, immutable digest, complete-cohort, producer-workflow, and artifact-integrity checks remain fail closed.
- [ ] MCP credential isolation, credential rotation, artifact secret scanning, and fresh-runner coverage remain intact in their new E2E location.
- [ ] Workflow-boundary tests prove publication and runtime-qualification conclusions are independent.

Start with .github/workflows/managed-images.yaml and trace the three live qualification jobs, their publication boundary, and the normal E2E workflow's resolver. Confirm how exact-head cohort receipts and immutable producer checks are passed downstream. Done means qualification runs independently, selective E2E can reuse a valid published cohort, and workflow-boundary tests preserve fail-closed and MCP security checks.

Written by the indexing model from the issue text.