ci: verify immutable eval release recovery

[abrichr]

PR #296 merged the base Release App and lifecycle workflow contract. This follow-up closes the immutable PyPI recovery gap that remained after that merge.

The release job checks any existing PyPI files before skip-existing can upload a missing file. It accepts an absent release or an exact subset. It refuses an extra file or a mismatch in the project, version, package type, yanked state, size, SHA-256 digest, source host, or downloaded bytes. A strict post-publication check then requires the complete wheel and source distribution.

GitHub Release publication still uses a same-job, repository-scoped openadapt-release token. The workflow checks the App slug before the write. It also verifies the exact tag, App author, and immutable asset set.

The Release, Lifecycle, and Docs App identities don't exist yet. The protected release environments and the Docs dispatcher also remain. This PR stays draft until those dependencies exist and a fresh Ops plan accepts the exact workflows.

Merging this PR won't create an App, environment, tag, release, admission, deployment, secret, or repository setting.

Checks

• Exact reviewed head: b3dd56fadb98fba442e8fab9df42fecb6b33612f
• Exact base: ef55e01ebe08382c9a05675d491dfbc297ed6d5e
• Hosted-equivalent suite: 2,478 passed, 56 skipped, 17 deselected
• Focused release suite: 28 passed
• Exact wheel and source distribution built for version 0.93.0
• The source tree and both built archives passed the public source-boundary check
• Ruff, formatter, actionlint, and diff checks passed
• Independent review found no remaining release fail-open path