fix(packages): retire private build-image grants

[zoeyrose]

Summary

• retire the private classic-build and windows-build Actions-access grants
• govern the owner-approved transition to public reusable toolchain images
• require anonymous immutable-digest access and preserve package/source identity
• keep private-grant validator coverage genuine with a complete temporary fixture

Live transition

After this desired-state change merges, package IDs 14345002 and 14204802
will be changed from private to public. Only the obsolete atrinik/classic
Manage Actions access entries will be removed. Source association remains
atrinik/devcontainer.

Validation

• bin/validate
• Bash syntax and ShellCheck for all governance scripts/tests
• every tests/*.sh regression
• actionlint
• read-only bin/publish plan; no deletions or policy relaxations
• read-only bin/verify-manual-settings
• git diff --check

[github-actions]

🎉 This PR is included in version 1.8.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀