Add event, schedule and manual workflow triggers

Why

A workflow could only start from a push. This adds the rest of the trigger surface in #138, including the issue and comment triggers requested on top of that section.

What changes

• Add on.push.paths and on.push.paths-ignore, with * inside one path segment and ** across segments.
• Support ! exclusion in branch and tag patterns; the last matching pattern wins.
• Add on.change_request with opened, updated, ready, closed, and merged.
• Add on.issue (opened, edited, closed, reopened) and on.comment (created, edited, deleted) for comments on issues and change requests.
• Add on.schedule with five-field UTC cron expressions.
• Add on.workflow_dispatch with typed inputs, a Run workflow page on the workflows page, and vole workflow dispatch over SSH.
• Pin a run’s trigger, action, event payload, and an occurrence in the queue. The occurrence keeps pushes idempotent while allowing the same commit to run again for a later event or schedule slot.
• Expose the pinned event to steps as VOLE_EVENT, VOLE_EVENT_ACTION, and VOLE_EVENT_PATH, pointing at /run/vole/event.json.
• Change-request event runs check out the base tip and carry base_sha, head_sha, and changed_files in the payload, so an event cannot execute an unapproved contributor head.
• Reconcile issue, comment, and change-request events from metadata-branch commits, with a spool fast path for CLI writes and a wake path for browser writes.
• Reduce output when events owe no runs: an event-only workflow no longer gets the every-branch push default.
• Stop a push from cancelling queued event runs at the previous tip.
• Document the triggers, dispatch inputs, schedule syntax, and event data.

Checks

• git diff --check
• go vet -tags sqlite_fts5 ./...
• vole workflow run verify — formatting, vet, build, licenses, govulncheck, packaging, links, and race tests all passed.
• New tests cover the trigger parser, cron matching, path filters, dispatch inputs, issue/comment events, change-request payloads, the dispatch page and CLI, and one-per-slot schedule queuing.

Part of #138. This does not close the tracking issue.