[CI] Bundle artifact cleanup never deletes uploaded bundles

## Affected revision

`52b3ab0606d14300ba30a6a46c155c5892a06381` on `jdk17u-target8`.

## Problem

The `Remove bundle artifacts` job in `.github/workflows/main.yml` does not delete the bundle artifacts uploaded by the build jobs.

There are three independent conditions in the current implementation:

1. Uploaded artifact names start with `CompoundVM_`, for example `CompoundVM_8.17.4_linux_x64_release.tar.gz`.
2. The cleanup filter is case-sensitive and selects only names for which `startswith("cvm")` is true, so it selects none of those artifacts.
3. The workflow declares only `contents: read` and `pull-requests: write`. Deleting Actions artifacts requires `actions: write`.

Both API calls use `curl -sL` without `--fail`, so an authorization error also does not make the cleanup step fail.

## Evidence

Run https://github.com/bytedance/CompoundVM/actions/runs/31759722955 retained all six bundle artifacts after the workflow completed:

- `CompoundVM_8.17.4_linux_x64_fastdebug.tar.gz`
- `CompoundVM_8.17.4_jvm_patch_linux_x64_release.tar.gz`
- `CompoundVM_8.17.4_linux_x64_release.tar.gz`
- `CompoundVM_8.17.4_linux_aarch64_fastdebug.tar.gz`
- `CompoundVM_8.17.4_jvm_patch_linux_aarch64_release.tar.gz`
- `CompoundVM_8.17.4_linux_aarch64_release.tar.gz`

They have since expired through the normal retention policy, rather than being removed by this job.

## Impact

Large build bundles (about 1.1 GB in the example run) remain stored until the repository retention period expires. The cleanup job reports success even though it performs no deletion.

## Suggested direction

A direct `actions: write` grant to the pull-request workflow is not sufficient for fork pull requests and would broaden the permissions of a workflow that builds untrusted contributions. A narrowly scoped base-repository `workflow_run` cleanup workflow may be more appropriate. It should:

- run only for the intended build workflow and completed run ID;
- use `actions: write` only in the cleanup workflow;
- match the actual `CompoundVM_` artifact prefix;
- make HTTP failures fail the step;
- avoid checking out or executing pull-request code.

## Why there is no PR with this report

The correct fix changes the CI trust boundary and requires a maintainer decision about workflow structure and permissions. I have therefore limited this contribution to an issue instead of adding a privileged workflow without prior approval.

I searched existing issues, pull requests, branches, and the history of `.github/workflows/main.yml`; no equivalent report or pending fix was found.

Start with the Remove bundle artifacts job and permissions in .github/workflows/main.yml, then review the reported artifact names and cleanup API calls. Confirm the intended base-repository workflow structure with maintainers before changing the trust boundary. Done means CompoundVM_ artifacts are removed after the intended completed run and HTTP or authorization failures are reported.

Written by the indexing model from the issue text.