Improve CI cache isolation and immutable release publishing

[helly25]

Run branch validation in PR context, restrict shared cache writes to main, and publish standard releases only after their assets are uploaded. Add the shared MBO Works artwork and contributor rules while preserving the Linux/macOS matrix and existing Starlark and shell conventions.

AG;DR

• Adapt applicable lessons from Bound clang-tidy workers and improve CI caches and publishing proto#100 and xff#835–848 (excluding #841). This is an independent PR from a clean temporary clone of current main; no cross-repository merge dependency.
• Main and numeric tags retain push checks; PRs, including forks, get their own required-check context without duplicate branch-push matrices. Cancel only superseded PR runs. Keep every existing job in done.
• Use setup-bazel's native cross-platform paths and dependency/build-hash caches; only main writes. Keep small Bazelisk/repository caches and report compressed inventory in main's final job. No C++ cache budgets or clang-tidy machinery are imposed on this shell testing repository.
• Pin the shared release workflow to proto's v7.7.0 commit and select stable publication, allowing action-gh-release v3 to upload assets before final publication. Disable cache mounting in the upstream release build, which lacks a main-only save control. Keep BCR publication after the release and preserve numeric tags and version checks.
• Decorate only the complete staged Pages copy with favicons; retained release snapshots remain untouched. Add a 64-pixel README logo and publication mappings for the new docs.
• Add AGENTS/GIT_RULES/STYLE_SH and link them from existing contributor rules. Preserve Beautysh, Buildifier, API compatibility rules, and bashtest fixture and cleanup ownership.

Validation during development: all five Bazel tests, all 31 Python infrastructure/publishing tests, and full pre-commit passed. All PR checks passed on the pushed head, including the complete OS matrix and generated site links. No release or Pages deployment is performed by this PR; actual publication remains tag/main automation.