test: establish code quality and QA gates

[pacharanero]

Summary

• add a stable maintenance roadmap, reproducible baseline, public/serialized contract tests, reference vectors, and chart-output characterization
• introduce staged Ruff checks plus isolated candidate-wheel inspection, installation, resource smoke tests, and a downstream compatibility runner
• align the Trisomy 21 AAP one-month cutoff with the first published LMS row and test adjacent floating-point boundaries
• expose rcpchgrowth.__version__, share it with measurement provenance, repair fresh-kernel notebook execution, and run every notebook in CI
• automate validated release-PR merges through exact-commit tagging, GitHub Release creation, one checked artifact set, and PyPI Trusted Publishing
• add a non-publishing historical release validation path and update s/version++ so merging the release PR is the final human release action

Status

This remains a draft visibility PR. R16-R19, R2, and R24 are complete. R20/R21 await the existing exact preterm-boundary PR #101 decision. R22 remains partial until R4-R8 define final package contents. R23 remains partial until digital-growth-charts-server PR #280 merges and provides an immutable compatibility revision. R1 is blocked on the public thrive-line return contract and clinically validated scope recorded in spec/queries.md.

No clinical golden fixture values or reference datasets are changed.

Verification

• full suite: 145259 passed, no skips
• focused boundary, provenance, wheel, shell, and release-policy suite: 76 passed
• all four notebooks executed headlessly from fresh kernels
• isolated built-wheel validation and installed-resource smoke passed
• Ruff passed
• Zizmor strict collection passed with no findings
• all GitHub Action pins verified against current upstream tags
• historical release validation passed against merged PR chore(release): v4.6.2 #105 / v4.6.2
• s/version++ --dry-run passed
• git diff --check passed