feat: prepare official Temporal release candidate pipeline

[bobisme]

Scope

Prepare official temporal@0.1.0-rc.1 for the published Sigil 0.35.0 host.
The three-operation component, WIT, and protobuf semantics are unchanged.

• Separate local development packaging from the canonical release candidate.
• Pin the public supporting archive and executable SHA-256 identities; verify
  the executable before and after every release validator invocation.
• Add pinned CI, first-attempt candidate creation, and main-only keyless
  publication of the exact independently approved three-asset tuple.
• Preserve immutable releases, no-rebuild publication, and burned-version
  handling after partial external writes.

Validation

Full checks pass, including 24 Python tests without skips. Two independent
clean checkouts acquired the actual public Sigil binary and reproduced the
same package bytes, running all 12 actual WASM-component conformance calls.
The executable-identity regression uses harmless mismatched bytes and mocked
invocation; it does not claim isolation from arbitrary concurrent same-user
compromise. Independent source security review remains a merge gate.

This PR is not artifact publication or real Temporal/CAPI acceptance. After
merge, the first-attempt candidate requires independent exact-source/run/digest
approval before publication. Stable 0.1.0 additionally waits for real CAPI
caller-replacement acceptance through ordinary provenanced project execution.