CI: dispatch-only cold-build reproducibility workflow

Proves a fresh clone builds the release image on a hosted runner
(sibling checkouts for meta-openglow and the kernel-module externalsrc,
rm_work to fit the disk budget) and publishes artifact checksums for
comparison against locally built releases. Never produces release
artifacts - releases are built and signed on the maintainer's host.

kas/ci.yml

@@ -0,0 +1,16 @@
+# CI overlay for the cold-build reproducibility workflow: merge after the
+# main config (kas build kas/forgefirm-glowforge.yml:kas/ci.yml).
+# rm_work keeps the build inside a hosted runner's disk budget; the
+# release image alone is built (the dev image adds nothing to the
+# reproducibility question).
+
+header:
+  version: 14
+
+target: forgefirm-image
+
+local_conf_header:
+  ci: |
+    INHERIT += "rm_work"
+    BB_NUMBER_THREADS = "4"
+    PARALLEL_MAKE = "-j 4"