ci: unify operator FerrFlow config into a single .ferrflow

[BryanFRD]

@

What

Collapses the operator's two FerrFlow config files into one. The docker + helm publishers (previously in ferrflow.publish.json) move into .ferrflow, which now carries workspace.deferPublish: true; ferrflow.publish.json is deleted and publish.yml drops its FERRFLOW_CONFIG override.

Why

The split existed because ferrflow release runs publishers inline, and the release job has no docker buildx / helm — so a separate config kept release from trying to publish. deferPublish (FerrLabs/FerrFlow#583, v5.10.0) removes the need: ferrflow release skips publishers, the tag-triggered ferrflow publish job (which has the toolchain) runs them from the same .ferrflow.

Verification

With v5.10.0 locally against the unified .ferrflow:

• ferrflow check (release path) → no publisher output (deferred, correct)
• ferrflow --dry-run publish → resolves ferrvault-operator @ <version> and runs both docker + helm publishers

publish.yml YAML valid. The release job runs latest FerrFlow (now v5.10.0), so deferPublish is honoured.

Closes #157
@