Add reusable job authorization manifests

[lox]

Why

Buildkite’s trusted GitHub Actions plugin upload needs compiler-owned, per-concrete-job authorization evidence before issuing GITHUB_TOKEN across local reusable workflows.

Pairs with buildkite/buildkite#32402. Closes #160.

What

• Emit canonical BUILDKITE_GHA_JOB_AUTHORIZATION manifests only for concrete jobs that statically require GITHUB_TOKEN, including recursive composite-action defaults.
• Preserve each exact local reusable-workflow caller chain and bind its effective permissions to the existing concrete plan digest.
• Match GitHub permission inheritance and replacement semantics while rejecting nested elevation above the caller ceiling.
• Replace workflow-wide reusable-call exclusion with compiler-verified per-job hosted admission, retaining the explicit root-permissions opt-in and existing provenance boundaries.
• Document the expanded supported subset and add focused authorization, sibling-path, nested-action, permission, cycle/depth, and tokenless coverage.

Verification

• mise run check