fix(release): publish native chain from reviewed main

[abrichr]

Summary

• replace native tag-push and release-event publication with one explicit workflow dispatch from reviewed main
• make the engine release publish an attested provenance receipt for its exact wheel, sdist, tag, release, and semantic-release lineage
• require the native transaction to verify that receipt before any platform build
• publish and attest the exact native provenance, SHA256SUMS, verified index, and strictly monotonic stable channel
• remove native tag creation from Native Installer Freshness
• make partial publication retries fill only missing identical assets and refuse byte replacement
• align release policy, signing guidance, health remediation, and the standalone verifier with the main-origin trust identity

Safety properties

The transaction refuses a stale main SHA, a version mismatch, a moved engine tag, an invalid or unsigned engine receipt, a non-production signing mode, a lower native version, an existing conflicting tag or release, an expanded asset inventory, a changed prior channel, or any checksum mismatch.

The publish job remains behind the native-release environment. This pull request does not publish a release and does not change repository rules, environments, or secrets.

The existing release hold for the openadapt-flow 1.31.0 pin remains in force.

External activation after merge

• add the no-bypass main ruleset and immutable v* and desktop-v* tag rules
• permit the native-release environment on main
• configure Apple Developer ID and notarization credentials
• configure one Windows Authenticode method
• verify PyPI Trusted Publishing for the main release workflow

Validation

• 1,039 repository tests passed
• 119 focused release, signing, metadata, and packaging tests passed
• actionlint passed for all changed workflows
• Ruff passed for all changed Python files
• git diff --check passed