fix(proton): let empty-trash start its pipeline in the image

[jshvn]

task empty-trash (host side, asks first) runs task op -- task empty-trash-pipeline. Inside the image that is a command-line call, and go-task refuses an internal task there ("Task "empty-trash-pipeline" is internal", verified on 3.53.1 in the image and 3.54.0 on the host). So task empty-trash could not work in github. Found during C8; the owner approved fixing it in v2.6.0. dropbox has its own copy, fixed in its phase 4 PR.

• proton.yml: empty-trash-pipeline is no longer internal; a comment says why. It has no desc, so it stays out of task --list.
• examples/proton: offline proves the name starts from the command line (task --dry empty-trash-pipeline). With internal: true put back, offline fails (exit 201).

internal was never a permission boundary (task op -- <cmd> runs anything in the image with the secrets), and CI cannot name a task (validate-vars.sh refuses any word that is not KEY=value).

Test plan

• task run -- task offline and task check in examples/proton
• Negative control: internal: true restored -> offline fails
• pipeline's dry render byte-identical, so no consumer's render.txt moves