Publish firmware preview builds

[cofob]

What

Adds automated preview firmware publishing for RS-Key pull requests and main builds (https://rskey.fob.wtf/preview).

The existing firmware matrix now applies the partition table before UF2 conversion. A separate trusted workflow_run publisher uploads the 20 supported variants to rs-key-flasher with commit, PR, SHA-256, and GitHub run metadata. It excludes all no-touch variants and adds one stable preview link to each PR.

No new firmware build jobs are added.

Autofix for issues was applied with zizmor lint tool.

How it was tested

• nix develop -c ./scripts/check.sh passes locally
• On hardware: board = N/A, what was exercised = N/A
• Host-only change (CLI / docs / CI) — no device behavior touched

Additional checks:

• node --test .github/scripts/publish-preview.test.mjs — 6 tests passed
• node --check .github/scripts/publish-preview.mjs — passed
• actionlint -no-color -oneline — passed

Checklist

• N/A — this is a host-only CI/build change; config.device_release is unchanged
• N/A — no device downgrade or rollback behavior changed
• N/A — no new or changed unsafe
• N/A — no device user-visible behavior changed
• New files carry the SPDX header (AGPL-3.0-only)
• Commit messages use the zone prefix style (fido:, piv:, rsk:, docs:, …)