feat(validation): lock published release-plan attribution

[hdamker]

What type of PR is this?

enhancement/feature

What this PR does / why we need it:

Extends P-035 so release-plan.yaml remains consistent with an already-published target_release_tag when the planned API entries still match that published release.

The PR adds two published-history subchecks:

• attribution drift: for PR validation, compare repository.release_track and repository.meta_release in the PR head release-plan.yaml against the PR base release-plan.yaml, and reject changes while the plan still points at an already-published target tag;
• dependency drift: retain dependency tags from published release-metadata.yaml in the release-history snapshot, and reject changed dependencies.commonalities_release or dependencies.identity_consent_management_release while the plan still points at that already-published target tag.

Unchanged parked plans remain valid, and a new release cycle using an unpublished target_release_tag is not blocked.

Related to #232.

Which issue(s) this PR fixes:

Fixes #356

Special notes for reviewers:

Validation run locally:

python3 -m pytest validation/tests -q

Result: 1151 passed.

Changelog input

 release-note
Extends P-035 release-plan published-history validation to reject attribution and dependency drift for already-published target release tags.

Additional documentation

This section can be blank.

docs

[rartych]

LGTM

[Kevsy]

LGTM