feat: prepare keyless provenance release

[bobisme]

Prepares the reviewed P6 keyless GitHub OIDC/Sigstore release path.

• builds one deterministic package and canonical release manifest from main
• binds publication to the exact first-attempt candidate run and approved SHA-256 tuple
• uses commit-pinned Actions and a protected release environment
• fails closed on any existing or partial tag, release, or attestation
• does not publish a release; rollout remains manually gated in Sigil bn-3unq

Independent review: codec cr-2cipqu, template cr-12722s, mysql cr-lt0uw4.