Allow always-running action policy preflights

[rmcdaniel]

Summary

• allow the reviewed central action-policy preflight to run unconditionally
• retain the transitional GitHub-only condition while downstream repositories migrate
• keep the existing read-only, immutable-action, credential-free checkout, and fail-closed gate requirements
• add a regression test for Waterline's simpler public-GitHub workflow shape

Validation

• focused qualification-policy tests pass
• the exact candidate workflow from Remove prerelease release recovery machinery waterline#98 validates successfully
• git diff --check passes

This removes a retired alternate-runner assumption exposed while completing #115.