ci(orchestrator): auto-generated deps.json + central orchestrator + receiver templates

Replaces the hardcoded shockwave fan-out in release.yml with a single
notify-orchestrator step that emits package-released. The orchestrator
workflow reads .github/deps.json (now auto-generated by
scripts/build-deps.py from real go.mod / package.json / Package.swift)
and computes the reverse-transitive closure of the released package,
then dispatches per-target bump-upstream events in topological order.

Why this is better than the hardcoded fan-out:

  - Adding/removing a sibling no longer touches release.yml; just create
    or delete the repo and the next deps refresh picks it up.
  - The graph is always in sync with reality. scripts/build-deps.py
    parses live go.mod files; refresh-deps-graph.yml runs hourly and on
    repository_dispatch deps-touched. When the regen produces a diff
    it opens (or updates) auto/deps-graph-refresh PR.
  - Sibling-to-sibling edges that the hardcoded shockwave missed
    (rendezvous → handshake → libpilot, eventstream → dataexchange,
    etc.) are now caught by including indirect requires.
  - Stable-only policy is honored per-receiver inside the orchestrator
    (the bump dispatch is skipped when upstream is a prerelease AND
    the receiver wants stable only).

Hand-maintained input is now only:
  .github/deps.policy.json — bump policy per node + freeloader markings
                              + manual_nodes for repos with no manifest
                              (homebrew-pilot, website, freeloaders).

Files in this commit:

  scripts/build-deps.py                       generator (gh + raw fetch)
  .github/deps.json                           auto-output, 27 nodes
  .github/deps.policy.json                    hand-maintained sidecar
  .github/workflows/orchestrator.yml          unchanged from prior commit
  .github/workflows/refresh-deps-graph.yml    NEW — scheduled regen + PR
  .github/workflows/release.yml               drop shockwave; add
                                              notify-orchestrator step
  .github/workflows/_template-emit-release.yml unchanged
  .github/workflows/_template-bump-upstream.yml unchanged

Required secret: SHOCKWAVE_DISPATCH_TOKEN (repository_dispatch scope on
every sibling + the orchestrator's own repo).

Author: teovl