Pin runner images and protect whole-engine coverage

[masarray]

Purpose

Complete the low-risk P2 workflow and coverage hardening before the physical shared-engine source migration.

Changes

• Pin CI, CodeQL, and Windows release validation to windows-2025.
• Pin GitHub Pages and release publication to ubuntu-24.04.
• Add scripts/validate-public-site.py to the GitHub Pages path trigger.
• Enforce a 5.5% whole-engine line-coverage regression floor in addition to the existing 50% protocol-core floor.
• Report both coverage floors in logs and the GitHub job summary.
• Preserve immutable Action commit SHA pins and locked NuGet restores.

Validation completed

• CI locked restore: success.
• Public-site generation and recursive validation: success.
• Publisher and Subscriber warning-free builds: success.
• Unit tests: success.
• Whole-engine 5.5% coverage floor: success.
• Protocol-core 50% coverage floor: success.
• Publisher and Subscriber vulnerability reports: success.
• Full-solution CodeQL analysis on windows-2025: success.
• Portable applications, installer, CycloneDX SBOM, silent install/uninstall, checksums, and private release artifact on windows-2025: success.
• Public release job on the PR: correctly skipped.

No runtime protocol behavior or public release is changed by this pull request.