Give package tags their own update feed and OctoShoom workflow

[Llewellynvdm]

The package now owns its update feed and checksum workflow, separate from the component.

A v* tag push triggers this repository's workflow. It reads the generated manifest at that exact tag, adds the package's automatic GitHub tag ZIP to its own feed on main, and calls native OctoShoom. Git User is configured once. Tag-only triggering prevents feed/hash commits from triggering another hash run.

The maintained workflow, feed, helper, tests and instructions live under .github, which current native OctoJPack repository replacement preserves. No unsupported ignore option or engine modification is needed. Component PR #5 points the generated package manifest here and hashes the component before packaging: joomengine/mcp_component#5.

Validation on c129762:

• Package metadata CI passes: https://github.com/joomengine/mcp_package/actions/runs/36459238579.
• 14 metadata checks cover first/subsequent versions, reruns preserving hashes and invalid tag/manifest combinations. PHP/XML/workflow syntax and whitespace checks pass.
• Actual current OctoJPack configuration loading and manifest generation, using the updated .octojpack, interoperate with this exact helper. Six assertions verify the package feed URL, package tag ZIP, identity/site client, version and shared changelog.
• Disposable tests using actual native replacement/copy/commit/push functions confirm .github workflow/script/feed preservation in both main and tags across two successive versions.

Merge this PR before the component PR and before publishing the first package. Make the six documented Git User secrets available to mcp_package for its own feed commits and OctoShoom run. The feed stays empty until an actual package tag exists. No production tag or release is created by this PR.