feat: add contributor CI workflow for fork-friendly testing

[abtreece]

Summary

Adds a credentialless CI workflow that runs on contributor forks and PRs, enabling third-party contributors to validate their changes without access to project infrastructure.

• Contributor CI workflow (ci-cd-contributor): Builds Ruby packages for two representative distributions (Ubuntu 24.04 and EL 9) with applicable variants and runs smoke tests. No cloud credentials or special setup needed.
• ok-to-test label gate: Maintainers can add the ok-to-test label to trigger the full CI pipeline (all distros, test publishing) against a PR. A label guard workflow automatically removes the label when new commits are pushed, requiring re-review before re-triggering.
• Main workflow restriction: The main CI/CD workflow now checks github.repository to avoid running on forks.
• Variant exclusion support: Contributor workflow respects variant_exclusions from config.yml (e.g., skips malloctrim for Ruby >= 3.3).
• Test script fixes: createrepo → createrepo_c in RPM test prep, added adduser package for DEB tests.
• Documentation: Updated CONTRIBUTING.md with fork CI and local build/test instructions.

Closes #54

Test plan

• Verify contributor CI workflow runs on a fork push (no secrets required)
• Verify ok-to-test label triggers full pipeline on PR
• Verify label guard removes ok-to-test on new push to PR
• Verify main CI workflow does not run on fork repositories
• Verify generated YAML matches ERB template output (./internal-scripts/generate-ci-cd-yaml.rb)
• Verify malloctrim variant is excluded for Ruby >= 3.3 in contributor workflow