[codex] Prepare OrangeFox GitHub build lane

[Fractal-Echo]

Summary

• Adds GitHub validation and a manual OrangeFox recovery build workflow for NX809J/canoe/sm8850.
• Tightens public repo hygiene with forbidden-artifact checks and safer ignore rules.
• Aligns the documented build flow around orangefox_NX809J-ap2a-eng and device/nubia/NX809J placement.
• Keeps assets/abl_unlock.elf with a pinned SHA-256 because it is the RM11 Pro full-fastboot ABL artifact.
• Flattens public release notes and hashes into assets and removes obsolete TWRP/reference candidate trees and scripts.

Safety Notes

This remains WIP recovery-port work. The PR documents build-pass / flash-pass / boot-fail / rollback-pass history without labeling the recovery stable or usable.

The workflow avoids device-write commands, release mutation, GitHub secrets, and private maintainer paths. Full build is manual-only because OrangeFox sync/build is large for hosted runners.

Validation

• git diff --cached --check
• git diff --check
• bash scripts/ci/verify-orangefox-github-build.sh
• bash scripts/ci/verify-recovery-route1.sh