Publish assets before immutable release lock

[biru-codeastromer]

Summary

• bind release dispatch to the exact protected version-tag revision, protected-main history, generic tagger identity, and exact public annotation
• rely on organization-enforced release immutability, with resumable draft uploads and retryable closure
• sanitize generated contributor credits and validate every public release-note and existing-release metadata class before publication
• require exact local and remote asset names, API SHA-256 digests, and bytes for draft publication and published-release reruns
• pin the release build tool and document later rebuilds as fail-closed integrity checks

Repository controls

• organization policy enforces immutable releases for this repository
• the active refs/tags/v* ruleset blocks updates and deletions with zero bypass actors
• the repository Actions policy requires SHA-pinned action references
• protected main requires strict checks, admin enforcement, one approval, stale-review dismissal, last-push approval, conversation resolution, and linear history; force pushes and deletion are disabled

Validation

• local make release-gate: 104 passed, 1 optional skip, 91.83% coverage
• hosted Python 3.11 through 3.13 coverage: 91.65%; hosted Python 3.14 coverage: 91.56%
• committed contract tests cover trusted dispatch, tag and protected-main resolution, draft recovery, metadata validation, exact draft and published asset sets, immutable closure, and automatic attestation verification
• package, dependency, example, text, repository, and Gitleaks audits passed
• the combined exact-head stack through Attest exact release provenance #39 passed 232 tests with 1 optional skip and 93.18% coverage

This PR requires eligible reviewer approval before merge. No release or tag was created.

[biru-codeastromer]

Superseded by merged #41, which preserves this change in the protected v0.4.0 release stack.