feat: retain durable EP release operation before publication

[pcvantol]

Problem

EP’s source release workflow retained its operation record only in runner artifacts and did not prove original pre-PyPI provenance or safely resume cleanup.

Change

• binds a full-SHA operation ID and stores QUALIFIED provenance in a draft GitHub Release before publication;
• validates exact wheel/sdist identities and durable receipt before a PyPI mutation;
• reads back both registry distributions, qualifies the installed registry wheel, and distinguishes PUBLISHED, CLEANUP_PENDING, and RELEASE_COMPLETE;
• enforces lock-owned immutable release transitions and recovery validation;
• reloads a persisted cleanup-pending receipt before terminalization.

Validation

• full isolated wheel/sdist qualification: 1,416 tests passed; 84.48% coverage; ingress, deterministic E2E, and HTTP/OpenAPI/Postman checks passed;
• focused release-operation/productization tests: 58 passed;
• YAML parse, extracted shell syntax, projection validation, and git diff check passed.

No release, PyPI publication, live installation, or artifact deletion is performed by this PR.