Improve & simplify redist auto-update automation

[sunnamed434]

Simplify/DRY:

• Add .github/variants.json as the single source of truth for all 10 variants; Update/Matrix/Verify build their matrices from it via jq + fromJson (removes the determine-variants job, the vars case block, the 68-line Matrix include, and the duplicated variant->dir case in Verify).
• Use fixed PR branches redist-update/ with delete-branch:true; drop timestamped branches and the broken existing-PR-by-title check.
• Drop dead .NET 6.0.x (tool is net9, DepotDownloader net8).
• Replace tj-actions/changed-files with native git diff.

Robustness:

• Remove continue-on-error masking; failures now surface (fail-fast:false keeps other variants running). Validate the manifest id and .commit file; capture redist-tool output; set -euo pipefail in the nuget-pack action.
• notify-failure job opens/updates a tracking issue on scheduled failures.

Security:

• Pin all third-party actions to commit SHAs; pass Steam/NuGet secrets via env.

Verify depth:

• Add SHA-256 verification against manifest.sha256.json and a newer-build gate keyed on the Steam BuildId (monotonic across upstream rollbacks); a NuGet version dip is a warning, not a block.

Docs: add ARCHITECTURE.md + architecture.svg (pipeline diagram), link from README, allowlist them in .gitignore, and ignore stray redist/**/*.nupkg.