Separate component and package update feeds

[Llewellynvdm]

The component feed previously identified and downloaded the combined package. This realigns it with the requested independent update ownership.

• The component feed identifies com_joomengine_mcp / component / administrator and downloads this component's automatic GitHub tag ZIP.
• The manual release publishes the component tag and feed, calls OctoShoom, then calls OctoJPack. Git User remains configured once; no shared-engine work is duplicated.
• Every .octojpack source explicitly uses mode: tags. The package version follows the component tag, while the generated package manifest points to the separate feed in mcp_package/.github.
• Package tags trigger their own feed/hash workflow in Give package tags their own update feed and OctoShoom workflow mcp_package#1. Native OctoJPack already preserves .github; the package workflow and feed live there, without inventing an unsupported ignore option.
• Agent guidance, both changelogs and rollout instructions record the separate feeds, package secret setup and the need to check both workflow runs.

Validation on 7b1526f:

• PHP contracts: https://github.com/joomengine/mcp_component/actions/runs/36459207363 — passed.
• Installed Joomla, all four PHP/database combinations: https://github.com/joomengine/mcp_component/actions/runs/36459207244 — passed.
• Installed JCB golden image: https://github.com/joomengine/mcp_component/actions/runs/36459207194 — passed.
• Local checks: 22 release transitions, 34 source-installability assertions, PHP/workflow syntax and whitespace.
• Current native OctoJPack generated a package manifest from this exact configuration that the package metadata helper accepted. Six assertions verify the package feed URL, tag ZIP, identity/client, version and shared changelog.
• Actual native replacement/publication functions preserved the package .github workflow/script/feed in main and tags across two disposable versions. Shared engines were not modified.

Merge package PR #1 before this PR and before releasing. The package repository needs its six documented Git User secrets for its independent hash workflow. The prepared 0.1.1 component metadata is not a published release; no production tag or package is created by this PR.