ci: enforce complete release gates and harden publication provenance #117

Problem

The latest main CI run has 20 successful jobs, but branch protection currently requires only five contexts: four Linux/macOS core combinations and shellcheck. Windows, wheel/sdist, install smoke, optional relay, MCP and Node control/integration jobs can fail without blocking a merge.

The publication workflow builds on a published GitHub release event and validates the tag against the Python version, but stable v1 should also make the protected-main and artifact provenance relationship explicit and reviewable.

Proposed behavior

• After the suite reorganization in chore: organize tests and CI by subsystem #113, add one stable release-gate aggregate job that depends on every release-critical matrix and packaging job.
• Require that aggregate check in branch protection with strict up-to-date status, avoiding a fragile list of every matrix-generated context.
• Keep deterministic fixture-only tests as the required gate. Live OAuth, model calls and production mutation remain separate operator evidence.
• Validate in the publish workflow that the release target is the intended commit on main, the tag and package version match, and the exact source produces the inspected wheel/sdist.
• Pin third-party GitHub Actions to full commit SHAs and use an automated reviewable update path.
• Continue PyPI Trusted Publishing through OIDC; do not add long-lived PyPI credentials.
• Publish artifact hashes and available provenance/attestation metadata, and verify downloaded PyPI artifacts against the workflow outputs.
• Add Python and Node runtime dependency audit results to release evidence. Dependency findings require review; do not use forced automatic downgrades or destructive audit fixes.

Acceptance criteria

• A deliberately failing Windows, packaging, install, relay, MCP or control job makes release-gate fail and prevents merge.
• Renaming or expanding a matrix does not silently remove it from the aggregate gate.
• Branch protection requires the stable aggregate context and an up-to-date branch.
• Publication rejects a mismatched tag/version, a release target outside protected main, altered archive contents or a failed artifact verification.
• Wheel and sdist are independently installed and smoke-tested before publication and again after downloading from PyPI.
• Workflow artifacts include checksums and provenance sufficient to tie package files to the exact commit and run.
• Actions and build tooling updates arrive as reviewable changes with CI, not floating unreviewed mutations.
• RELEASING.md documents the exact stable v1 gate, failure preservation and PyPI immutability rules.

Non-goals

• Making real provider OAuth, production relay traffic or model calls part of pull-request CI.
• Automatically publishing on every merge to main.
• Storing package registry tokens in repository secrets.
• Replacing chore: organize tests and CI by subsystem #113's test organization work.

This belongs in v1.0.0 and should be implemented after #113 establishes stable suite entry points.