ci: peel the forge live-contract oracle into its own peer job (RIG-2698 T3)

[rigel-mintaka]

This PR is part of a stack containing 3 PRs:

1. main
2. "ci: peel the forge live-contract oracle into its own peer job (RIG-2698 T3)" (this PR)
3. ci: peel the gtk3 multi-window e2e gate into its own job #611
4. ci: moon concern matrix; dissolve gates; gate every leg (RIG-2700 T5) #621

Third of the CI job-decomposition stack (design record
docs/designs/infra/ci/compass-ci-job-decomposition/design.md, § Plan → T3).
Moves the forge live-contract oracle out of the monolithic gates job into a
dedicated forge-oracle peer job behind the single required CI rollup, the
same peel T1 (pgtest) and T2 (microvm) applied to their legs.

Four consecutive steps move verbatim out of gates into the new job:

• Detect whether this PR touches the forge contract surface (id forge_affected)
• Mint the forge live-oracle's Linear app token
• Forge live-contract oracle (go test -tags livegithub -race)
• Assert the forge live-contract oracle ran rather than skipped

The new forge-oracle job runs on bare ubuntu-latest (no privileged container),
timeout 30m, TMPDIR /tmp, and carries the bootstrap the moved steps need to reach
their in-step detection: a fetch-depth-0 checkout (the forge-affected git diff
needs base history), the reviewed-caches nix install, and the phase-one language
toolchain step (bun for the mint, go for the oracle). Phase two (buf/protoc/
biome/chromium) is deliberately not copied — the oracle needs none of it.

The four moved steps keep their tri-event + same-repo-head step-level guards as
defense-in-depth, so a fork PR still skips the secret-bearing steps in-step. The
job itself runs unconditionally at this task (subject only to the shared
workflow_dispatch/edited job guard); hoisting the affected detection into a
setup job and gating forge-oracle at the job level is deferred to T5.

The CI rollup gains forge-oracle: added to needs and to the result
assertion (a hyphen-free shell var for the hyphenated job context, matching the
existing dogfood-e2e precedent). Also refreshes the dogfood-e2e D2 comment that
T3 falsified — the oracle now lives in forge-oracle, not gates.

Refs RIG-2698

Co-authored-by: Matt Wilkinson matt@rigel.build

[linear-code]

RIG-2698

[github-actions]

Compass engineering docs preview: https://compass-runner-2698-ci-forge.compass-eng-docs.pages.dev

Deployed from compass-runner/2698-ci-forge-oracle-peer-job at f3b5219.

The base branch was changed.