ci: publish report site after standard suite

[mgmobrien]

Summary

• upload each standard-suite shard's summary.json and metadata.json as GitHub artifacts
• add a post-suite publish-report-site job that runs after all shards, even when tests fail
• clone relay-harness, preserve the existing live manifest commit set, prepend the just-tested commit, and run publish-report-site-static.mjs --upload
• run live readback when Cloudflare Access service-token secrets are configured; otherwise publish still completes and logs that readback was skipped

Verification

• actionlint with shellcheck disabled for .github/workflows/e2e-standard.yml
• Ruby YAML parse
• git diff --check

Context

The RC tag workflow now runs the VM suite, but without this job the immutable shard artifacts can upload while the static report-site index/sidebar remains stale until a manual publish. This closes the automatic run-and-publish path for future RC tags and merge-hsm pushes.