ci: verify brew nspawn image weekly

[castrojo]

Closes #46

Summary

• add a scheduled and manually-dispatched workflow for the brew nspawn machine image
• run the existing just verify-brew contract on a native Ubuntu runner
• document the CI lane and route it from the skill index

The workflow intentionally verifies the tarball shape and required contents without attempting machinectl import-tar or booting systemd; those require a systemd host and remain an integration step.

Verification

• git diff --check
• just unavailable in this environment, so just verify-brew could not be executed locally