feat(studio): add provider-local thin releases

[zyn080302]

Summary

• preserve the legacy full offline studio-bundle.zip while publishing a separate digest-pinned thin archive
• publish provider-local, content-addressed runtime wheels and AgentKit CLI artifacts with exact uv.lock byte provenance and license gates; keep non-approved/source-built wheels private
• make publication retry-safe and public bucket policy/tag provisioning non-destructive
• require explicit workflow and Release Server opt-in; default release behavior remains full/offline
• let capable updaters verify provider-local artifacts and automatically fall back to the full bundle on any thin-path failure

Local release reconstruction reduced the update archive from 232,105,534 bytes to about 12.34 MB while retaining 7 private wheels and reusing 178 public artifacts across both providers.

Verification

• uv run pytest -q tests/test_studio_release_server.py tests/cli/test_studio_artifacts.py tests/cli/test_studio_release.py tests/cli/test_studio_self_update.py tests/cli/test_studio_companion.py (167 passed)
• uv run pre-commit run --all-files
• Pyright on all changed Python files (0 errors)
• uv lock --check (310 packages)
• workflow YAML parse and git diff --check

No Release Server or Studio Function was deployed by this change.