chore: establish Wright package publication boundary - #235

Summary

• Mark every Wright workspace package with publish = false.
• Make verify-dist.py fail if any workspace package becomes publishable.
• Document that the current release surface is binaries/package managers, not crates.io packages.

Verification

• cargo fmt --all -- --check
• cargo clippy --locked --workspace --all-targets --all-features -- -D warnings
• cargo test --locked --workspace --all-targets --all-features
• python3 scripts/verify-dist.py
• git diff --check

Scope and follow-up

This is the publication-boundary portion of #234. The source-language owner API migration remains intentionally pending: opy-rs v0.1.7 requires workshop-rs 0.1.16, while the released deltin-rs v0.1.1 and the open deltin-rs#33 compiler contract still use the older Workshop boundary. No local semantic/WIR duplication or text compatibility bridge was introduced.

Refs #234