ci: publish read-only runtime execution evidence

[Pigbibi]

Summary

• let the existing LongBridge PAPER heartbeat publish one bounded source for all LongBridge runtime reports
• reuse the existing GitHub OIDC identity and pinned QRS composite Action

Safety

• HK and SG heartbeat checks remain unchanged; only PAPER publishes, avoiding duplicate source records
• no strategy, runtime target, broker, or order path changes
• missing, stale, or incomplete evidence remains pending/parked

Validation

• git diff --check
• actionlint and existing CI run on GitHub.