Publish in a minute: build outside the lock, sign on a hosted runner (#869)

A one-package merge took 9 to 15 minutes to publish for about 15 seconds of
signing and upload. The run-wide concurrency group made each merge wait for
every earlier run, builds included (#854 waited 13 minutes behind an aarch64
batch), and the publish job waited about 3 minutes for a builder droplet
even when every package had a PR artifact and nothing needed building.

Build x86_64 trees that have no artifact in the rebuild job, one droplet per
entry, as aarch64 already builds there on arm64 runners: in parallel, with
no secrets, and outside any lock. The publish job now only collects
artifacts, signs and uploads, on ubuntu-latest with the GHCR builder image
(#850), and only it holds the publish group.

ci/README.md

@@ -80,8 +80,11 @@ changing them, on the box:
   packages then signatures then the db.
 - aarch64 under QEMU with credential-preserving binfmt. PR builds now run
   aarch64 natively on `ubuntu-24.04-arm` (QEMU was up to ~15x slower). When a
-  merged aarch64 tree has no artifact, publish.yml rebuilds it there too, in its
-  own job, and signs and uploads it on the droplet like a PR artifact.
+  merged tree has no artifact, publish.yml rebuilds it in its own job, aarch64
+  there and x86_64 on a droplet, outside the publish lock.
+- Publish itself builds nothing: it signs and uploads on `ubuntu-latest` in the
+  tested builder image pulled from GHCR, and only that job holds the `publish`
+  concurrency group, so a merge waits for seconds of signing, not for builds.
 - Vouch gate: collaborators, `.github/VOUCHED.td`, or the `build-approved`
   label; denounced authors cannot be overridden by the label.
 - Tests run on PRs only; `result`, `self-tests`, `build-isolation` are the