fix(ci): move shared diagnostics and iOS handovers to run-store

[sylphx-desk-studio]

Summary

• Move red-main current, previous, candidate and regression-window JUnit reads from GitHub artifacts to the existing BuildCache run-store.
• Discover exact sharded producer names from authenticated paginated run job steps using the explicit run-store put <name> contract; resolve the target repository ID and preserve exact matrix-job/test attribution through a metadata map.
• Treat incomplete shard retrieval as unread diagnostic evidence, never proof a test passed; retain lane fallback.
• Migrate optimistic-verify diagnostics and shared iOS workspace/IPA handovers to run-store; retain mandatory release delivery checks.
• Document producer naming, OIDC permission and cross-run scope requirements; add discovery regressions and update affected existing fixtures.

Verification

No builds, tests, linters, formatters, workflow reruns or billing calls were run, per assignment. No artifacts were deleted.
Review should run the run-store/JUnit, red-main and iOS-release Python regression suites and shared workflow lint after admission.

Rollout

Consumers must repin the shared workflow SHA and grant id-token: write. JUnit producers must use an explicit matching run-store put <name> top-level step name, including expanded shard names. External iOS prebuilt-IPA producers must publish the named run-store entry before callers adopt this head. Existing release/audit evidence remains untouched.

Merge ownership

Desk reviewer owns exact-head review and merge-queue arming via gh pr merge --auto --squash --match-head-commit d5c21651b7447684dfdaa734e69bea9e07bd8eac once required CI/review gates are satisfied. No bypass merge.

[sylphx-desk-studio]

1. B1 [class: missing-consumer-integration]: Complete the required successful authenticated consumer invocation before acceptance (PROJECT.md:33-36). tests/test_run_store_junit.py:47-66 replaces both GitHub metadata and run-store transport with mocks, and .github/workflows/project-control.yml:39-102 invokes only unrelated consumers. The passing suite does not demonstrate that the new reusable workflow checkout, caller OIDC permissions, producer-step discovery and cross-run retrieval work together. Supply a successful invocation at this head that retrieves sharded JUnit through run-store and preserves exact job/test identity, or add this consumer integration to CI and publish a new head. The submitted verification notes explicitly leave this check outstanding.