fix: make v0.7.1 release bundles self-contained

[atomize-lab]

Summary

• run frozen CLI operations in-process so packaged Windows/Linux servers never depend on host Python
• bundle DejaVu Sans for portable PDF generation and make runtime font lookup frozen-safe
• build a deterministic Linux tarball and reject unsafe or incomplete archives before release
• smoke-test the real background Job API on Windows and Linux with host Python removed from the server PATH
• align release docs and examples with the actual artifact names and startup commands

Release safety

• the previous v0.7.1 tag/release was removed before this repair, so no known-bad artifact remains downloadable
• tag recreation remains blocked until PR CI and post-merge main CI pass
• Release assets are attached only for tag-triggered runs

Validation

• 242 passed locally on Python 3.13
• release workflow YAML parse, bash -n, compileall, focused pyflakes, git diff --check: PASS
• Linux tar verifier: PASS (no links, bounded members, required executable modes)
• extracted frozen CLI with PATH=/nonexistent: validate, Markdown, and PDF generation PASS
• extracted frozen server with PATH=/nonexistent: /api/run validate Job reached done, returncode=0
• independent Grok-4.5 High review: VERDICT: PASS