ci(verify): automate downstream consumer verification fan-out (network_system, pacs_system)

[kcenon]

Closes #695

Summary

Adds .github/workflows/downstream-verification.yml — a workflow_dispatch fan-out that triggers the network_system and pacs_system sanitizer and integration-tests gates from a single invocation, replacing the four per-repo gh workflow run commands documented in VERIFICATION_GATES.md.

• Matrix: {network_system, pacs_system} × {sanitizers.yml, integration-tests.yml} (all four target workflows already expose workflow_dispatch).
• Cross-repo dispatch uses a DOWNSTREAM_DISPATCH_TOKEN secret — the default GITHUB_TOKEN cannot dispatch workflows in other repositories. A missing secret fails the job with actionable guidance.
• Each dispatch and a link to its result runs are written to the workflow's job summary.

Acceptance criteria

• Downstream verification can be triggered without manual per-repo commands — one workflow_dispatch fans out to all four gates.
• VERIFICATION_GATES.md reflects the automated path — the Downstream Consumer Verification section documents the fan-out as preferred (manual commands kept as fallback), and the Missing Gates / Follow-up gap is marked closed.
• Release checklist references the automated downstream result — added to the PRODUCTION_QUALITY.md production readiness checklist.

Test Plan

• Workflow YAML validated (parses; workflow_dispatch trigger + 2×2 matrix present).
• Functional dispatch requires the DOWNSTREAM_DISPATCH_TOKEN secret to be configured by a maintainer; the workflow self-reports a clear error if it is absent.

Setup note

To enable the fan-out, add a repository (or org) secret DOWNSTREAM_DISPATCH_TOKEN containing a PAT able to dispatch workflows in kcenon/network_system and kcenon/pacs_system (classic: repo + workflow; fine-grained: actions: write).