CI hardening: make rolling publisher push-only

[mark-e-deyoung]

Purpose

Narrow rolling-release mutation authority without changing engine code or the PR build/test feedback path.

Resolves the release-surface problem tracked in #2.

Change

Only two job conditions change in .github/workflows/compile-observer-smoke.yml:

• publish-experimental runs only for a push to semper/compile-observer;
• verify-public-channel follows that same push-only publisher path.

Observer/Linux/Windows build jobs remain available on the existing PR trigger with top-level read-only permissions.

Safety

This branch was created from the current public candidate and does not touch semper/compile-observer, so preparing this PR does not advance semper-exp-current.

The diff is workflow-only: no OXCE source, proprietary data, private validation evidence, or release artifacts are included.

Deliberate merge gate

Do not merge merely because this PR is mechanically ready: merging into semper/compile-observer is itself a push to the release-trigger branch and will run the rolling publisher. Merge when the current private promotion state allows that release transition.

Related follow-on hardening:

• Serialize rolling publisher so older pushes cannot overwrite newer candidates #3 serialize/supersede concurrent rolling publishers;
• Verify and enforce protection on the release-triggering candidate branch #4 verify/enforce authority controls on the release-trigger branch.

Closes #2 when merged.