Migrate Nextcloud-derived workflow families incrementally

[vitormattos]

Parent: #11
Related: #6, #34

Goal

Evaluate the selected Nextcloud-derived workflow families and migrate only the families that can be shared without product-specific or unsafe behavior.

Completed migration decisions

• REUSE — organization template, validated in consumers;
• info.xml lint — organization template, validated;
• PHP lint / coding standards — organization templates, validated;
• Psalm — organization template, validated;
• ESLint / Stylelint / TypeScript — organization templates; TypeScript validated in LibreSign;
• Node tests — organization template, validated in LibreSign;
• frontend build — npm-build.yml organization template, validated;
• Conventional Commits — organization template, validated;
• OpenAPI — organization template, validated;
• PHPUnit database workflows — explicitly remain consumer-local for now because LibreSign materially diverges from current upstream through product-specific system packages, submodules and coverage behavior;
• dependency approval / auto-merge — explicitly remain local until policy-compatible, per Define shared policy for dependency update and auto-merge workflows #34;
• npm audit remediation — remains local;
• App Store build/publish — organization template is cataloged; installation remains opt-in because credentials and release policy are consumer-owned;
• other release automation — remains local unless a generic credential/release contract is established.

The per-family rationale and future decision rule are documented in docs/workflow-family-decisions.md.

Completion here means every evaluated family has an explicit distribution decision; it does not mean copying every upstream workflow into the organization catalog.

Implemented/documented in #60.