ci: split .woodpecker/main.yml into tier-{0,1,2,3}.yml per ratified architecture

[BryanChasko]

heraldstack-core currently has two woodpecker config files in .woodpecker/:

• main.yml (full split-tier pipeline in one file, PR feat(ci): add split-tier Woodpecker pipeline — task #4 #43/44)
• tier-1.yml (minimal fmt/clippy/build/test, commit d0acdc4)

the ratified ci rebuild architecture requires one file per tier because woodpecker
publishes one github status per pipeline file, and branch protection needs tier-0 and
tier-1 as separate required checks. main.yml violates this pattern.

task:

• split main.yml into .woodpecker/tier-0.yml (draft + skip-ci + metadata gates),
  .woodpecker/tier-2.yml (semgrep + trivy async), and .woodpecker/tier-3.yml (nightly cron)
• delete main.yml
• do not touch tier-1.yml — that file is being rewritten in the current sprint
  to use the firecracker plugin

success criteria:

• four files in .woodpecker/ (tier-0.yml, tier-1.yml, tier-2.yml, tier-3.yml)
• main.yml removed
• each tier file gets its own github status check visible in PRs
• branch protection updated to require tier-0 and tier-1 (tier-2/tier-3 advisory)

depends on: current sprint tier-1.yml rewrite landing first