ci: add fixed-head acceptance artifact workflow

[IchenDEV]

Scope

Workflow-only change for the approved #104 acceptance artifact build. This PR contains no #104 product, test, or documentation changes.

• Manual dispatch only; no push, pull-request, schedule, tag, or release trigger.
• Hard-locks the build checkout to 31b3c7f614656c59855b7fd556734a11543fa9eb.
• Uses read-only repository permissions and disables persisted checkout credentials.
• Builds, verifies, archives, re-extracts/re-verifies, records SHA-256 values, and uploads a 14-day GitHub Actions artifact.
• APPROVED acknowledges only the authorized artifact build/upload. Hardware, licensing, product merge, and release remain separate human gates.

This PR does not close or merge #104.