Harden release preflight checks

[bordumb]

What changed

• Fix the OpenTofu competing-workflow test to recognize the valid fail-closed StateChanged loser outcome while still proving exactly one provider effect.
• Stress that synchronized race for 32 iterations.
• Move no-default-features workspace tests and canonical wire verification into authoritative pull-request CI through one shared release_preflight() path.
• Remove duplicate late executions from release-check.
• Fix deterministic source/assurance archives to use UStar path-prefix encoding and regress the exact long fixture path that failed release preparation.
• Version and refresh the frozen release-metadata identity.
• Record the complete release-builder gate audit and hosted-only exclusions.

Root cause

The OpenTofu test assumed a losing workflow could only replay or conflict. A valid schedule allows the winner to commit and release before the loser rechecks state, producing a typed StateChanged fail-closed result without a second provider effect.

The release archive used a GNU tar header whose path field is limited to 100 bytes. Adding the release archive prefix pushed a canonical fixture path past that limit. UStar's dedicated prefix field encodes the repository path without weakening path validation or determinism.

Evidence

• Full local cargo xtask release-check: passed end to end.
  • 32-round OpenTofu race passed under both all-features and no-default-features profiles.
  • Lean, Kani, refinement, Aeneas qualification, transport conformance, bindings, package smoke tests, live demo, and compliance passed.
  • Release evidence validated 28 crate archives and 33 total subjects.
• cargo deny check with pinned cargo-deny 0.20.2: passed advisories, bans, licenses, and sources.
• Production formal source closure: passed at b26371ada3c58adb5999f5e15bff34df8f21a8aaf2d4b9bda15cd8d725c49eab.
• Exact long-path deterministic archive regression: passed.
• Final focused 32-round OpenTofu race regression: passed.
• Formatting and diff whitespace checks: passed.

Affected claims

• Release preparation should not be the first execution of deterministic Rust feature-profile or wire gates.
• Competing same-scope OpenTofu workflows execute at most one provider effect.
• Source and assurance archives are deterministic for all currently tracked release paths.
• Frozen release metadata changes only under a new semantic identity.

Exclusions and remaining gates

• No packages, tags, RCs, attestations, or release artifacts are published.
• No hosted OIDC, SLSA attestation, immutable upload, reproduction comparison, or promotion is performed.
• Exact pinned Aeneas/Charon translation requires the hosted Nix toolchain and remains for formal-translation CI; the local source-closure, Lean, Kani, refinement, and Aeneas qualification gates passed.
• Pull-request CI must pass before merge.