Complete the protected v0.4.0 release stack

[biru-codeastromer]

Summary

This PR carries twelve preserved follow-up changes directly on the frozen streaming release head:

• Reject mutable GitHub Action references #26 rejects mutable GitHub Action references.
• Drop persisted checkout credentials #27 removes persisted checkout credentials and enforces workflow timeouts and concurrency policy.
• Gate release version consistency #28 gates release version consistency.
• Require canonical private seal envelopes #29 requires canonical private-seal envelopes.
• Redact absolute configuration paths from errors #30 redacts absolute configuration paths from errors.
• Normalize excessive structured input nesting #31 normalizes excessive structured-input nesting.
• Normalize invalid digest inputs #32 normalizes invalid digest inputs.
• Normalize non-byte key material #33 normalizes non-byte key material.
• Normalize plugin lifecycle failures #34 normalizes plugin lifecycle failures.
• Publish assets before immutable release lock #35 publishes complete assets through the protected immutable-release workflow.
• Publish exact release checksums #38 publishes exact release checksums.
• Attest exact release provenance #39 attests and verifies exact release provenance before publication.

Validation

• make release-gate: 232 passed, 1 optional skip, 93.18% coverage.
• Generic author and committer policy: passed across all 13 single-parent commits from clean main.
• Exact ancestry and certified patch or blob equivalence: passed.
• Tracked-text and prohibited-punctuation policy: passed.
• Dependency audit and clean package installation: passed.
• Full-history secret scan: passed across 98 commits with no leaks.

Supersession after landing

PRs #26 through #35, #38, and #39 remain preserved as source evidence. Close them as superseded by this combined PR only after this PR lands successfully. This PR does not modify or close any source PR.