ci(live): schedule safe contract validation

[joshrotenberg]

Summary

Claim issue #151 and schedule the existing safe live integration and compliance suites against the dedicated non-production Redis Cloud resources.

Closes #151.

Changes

• Adds a weekly Wednesday 14:37 UTC schedule and manual dispatch, isolated from pull-request CI.
• Fails closed when either credential or any pinned resource ID is absent/invalid, without printing values.
• Runs the 23 live tests and 169-operation compliance gate serially with destructive mode forbidden.
• Queues overlapping runs instead of cancelling cleanup in progress.
• Publishes only aggregate outcomes and status counts; no captured live payload enters the artifact.
• Preserves unrelated tags during the compliance replace-all lifecycle and adds a mock regression test for that guarantee.
• Makes interrupted subscription renames self-heal by stripping reserved test suffixes before restoration.
• Documents secrets, cadence, reproduction, cleanup guarantees, and destructive exclusions.

Validation

• Workflow YAML plus every embedded Bash script parses successfully.
• cargo fmt --all -- --check
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test --workspace including 99 doctests.
• tag_lifecycle_preserves_unrelated_tags passes with exact request-body matching.
• Live integration: 23 / 23 passed serially.
• Live compliance: 169 operations, PASS=66 DRIFT=0 FAIL=0 KNOWN-DIFF=6 SKIP=97 UNCOVERED=0.
• Payload-free summary is 72 bytes and contains only aggregate counts.
• Post-run cleanup audit: clean names, zero reserved test tags, zero test ACL rules.

Actions environment

The six approved credentials/resource IDs are configured as encrypted secrets in the live-contract-tests environment. Its custom deployment policy permits only the main branch. Secret names were verified without reading values; end-to-end dispatch follows merge because the new workflow is not yet present on the default branch.