Add rollback-judge skill

[RYDE-PLAY]

Summary

• Add rollback-judge as a read-only post-deploy review skill.
• Fetch public GitHub Actions monitor runs and commit-pinned deployment markers at execution time.
• Derive rollback eligibility and the prior healthy version from live source reads.
• Emit a bounded release.publish.approval answer while performing no deploy effect.

Human-review revision

• PR file list is limited to skills/rollback-judge; all runtime and official-skill index edits were removed.
• Default judge no longer accepts caller-supplied act_decision or act_target_ref.
• Dogfood reads failing run 29393017505 and prior successful run 29392993457 at runtime.
• The sealed review act targets the real failing run and records the source-derived rollback ref.
• Hosted harness remains deterministic using answers tied to those public immutable runs; post-publish dogfood uses the live network reader.
• The package-local typed outputs avoid a custom workspace packet schema.

Verification

• runx-cli 0.6.14
• local harness: 2/2 passed
• registry hosted publish harness: passed
• clean installed-package harness: 2/2 passed
• package: ryde-play/rollback-judge@sha-243da363bf91
• dogfood receipt: runx:receipt:sha256:6f84aadb5bdb4810691f53e5e1be088bc4653f1b5ee6256fb3d395520515a2d6
• runx verify: production signature valid, no findings
• evidence: https://cdn.jsdelivr.net/gh/RYDE-PLAY/frantic-102-rollback-judge@6ba5914c938a789ad4958484321b6b353b374bf1/public/evidence.json