Add hosted consumer UAT fixture

[thossullivan]

What changed

• adds a workflow-dispatch-only consumer workflow pinned to published model-eol@0.4.0
• adds an explicit config that isolates one deterministic retired-model fixture
• adds a real evaluator that verifies the isolated patch, selected plan, migration identity, and bounded report contract

Why

This is a temporary live UAT of the complete hosted plan -> evaluate -> publish artifact handoff. The private dev-bootstrap attempt was rejected before runner startup by its Actions billing gate, so this equivalent test runs in the owned public project.

After the workflow artifacts and generated migration PR are verified, the bot PR will be closed and this setup will be reverted.

Validation

• published model-eol@0.4.0 plan: exactly one patch item, zero issues, zero incomplete scan notes
• published isolated evaluator: pass, exit 0, report present, commit-bound base SHA
• workflow YAML and fixture scripts parse successfully