Add rc as a first-class channel: validation, shared repo root, rc build mirror

- helpers/paths.sh: validate_mirror/require_valid_mirror for the edge|rc|stable
  set, and REPO_ROOT (OMARCHY_REPO_ROOT override) so a secondary checkout like
  the rc branch worktree publishes into the same channel tree as the primary
- validate --mirror everywhere it previously accepted any string (sync-repo,
  promote-build, update-repo, clean-repo, remove-package) and widen the
  edge|stable checks in build, deploy, push-build, auto-release
- build/Dockerfile: rc builds compile against rc-mirror.omarchy.org

bin/check-versions

@@ -19,7 +19,7 @@ print_header "Package Version Check"
 get_repo_version() {
   local pkg="$1"
   local mirror="$2"
-  local repo_db="$BUILD_ROOT/pkgs.omarchy.org/$mirror/$ARCH/omarchy.db.tar.zst"
+  local repo_db="$REPO_ROOT/$mirror/$ARCH/omarchy.db.tar.zst"
 
   [[ -f "$repo_db" ]] || return 0