Stagger weekly package updates by repository

[woksin]

Changed

• Bootstrapped package updates run weekly on Mondays, at a stable per-repository time between 03:01 and 07:59 UTC. (part of Reduce GitHub Actions jobs and runner queue time across the organization #128)

[woksin]

Local requested gates passed:

• bash -n .github/scripts/bootstrap-common-workflows.sh
• git diff --check and staged diff check
• actionlint on every executable workflow (excluding the existing incomplete publish.template.yml) and seven generated package-update wrappers. The local config declares the existing cratis-arc / cratis-arc-small runner labels.
• pi-phase run --kind test --timeout 120 --queue-timeout 600 -- python3 -B .github/scripts/tests/bootstrap-schedules.test.py: 3 tests passed.
• pi-phase run --kind test --timeout 120 --queue-timeout 600 -- python3 -B .github/scripts/tests/bootstrap-package-update-safety.test.py: 5 tests passed on clean committed HEAD, without PACKAGE_UPDATE_DIFF_BASE. Its no-organization-write assertion therefore does not certify this PR diff: this deliberately changes the watched bootstrap script, and merge will invoke the existing organization-wide bootstrap.

The checksum is POSIX cksum of the exact repository name; offsets do not depend on repository enumeration order. All other templates, ignore lists, private runners, secrets and publishing triggers are unchanged. The private callers use the same checksum-derived offsets through separate PRs; Studio and Ensemble stay paused. The new schedule suite is an offline local gate; no live bootstrap or remote writes were exercised locally.

Based on origin/main, independent of ci/remaining-followups and ci/package-update-sdk-pin. Reconcile the shared bootstrap script with those PRs when integrating. No application builds/integration lanes were run for this workflow-template-only task; the owner-specified gate was used. No merge performed. Assigned to woksin; GitHub cannot request a review from the PR author.

[woksin]

Deployment approval is still required before merge: changing .github/scripts/bootstrap-common-workflows.sh triggers Bootstrap Common Workflows on main. It writes directly to default branches across non-archived, non-ignored Cratis repositories, installs their weekly package-update offsets, and can overwrite other wrapper drift. Ignored/custom-owned repositories remain excluded. Please explicitly approve that organization-wide write before merging; no merge or live bootstrap dispatch was performed.

The release-note wording and partial issue reference are corrected. The requested CI test step, both event path filters, README offline-check entry, and scheduled-update wording are prepared locally but not pushed: bootstrap-package-update-safety.test.py fails against this PR's actual base-to-head diff with "Changed files would trigger organization-wide writes" for the bootstrap script. Wiring the new paths into Verify Package Updates exposes that existing guard in CI. A decision is needed on how the separately reviewed bootstrap rollout should interact with the narrow package-update implementation guard; it has not been weakened or bypassed.

Actionlint and git diff --check passed. The schedule suite passed all three tests through pi-phase (120-second execution budget, 600-second queue budget). The safety suite failed one of five tests with PACKAGE_UPDATE_DIFF_BASE set to the real PR comparison base; a clean-HEAD run is not evidence for this PR's write boundary.