Release campaign: qualify an exact TestPyPI candidate before broad announcement

[jeffhuber]

Parent

Part of #709.

Problem

Remote providers can currently qualify only an exact package-index spec using the default index. That means broad provider qualification starts after production PyPI publication. Code Mower needs a bounded candidate source so release qualification can happen before the release is announced or marked current.

Initial design

Support an explicit TestPyPI candidate source across release qualify and release campaign:

• add closed, persisted package-source metadata rather than accepting arbitrary pip flags;
• support pypi (default) and testpypi sources;
• for TestPyPI use the canonical TestPyPI simple index and PyPI as the dependency-only extra index;
• preserve exact package name and version identity validation;
• include the source identity in campaign idempotency and remote dispatch/result binding;
• never persist credentials or arbitrary URLs.

This first PR does not need private artifact or authenticated GitHub Actions artifact support.

Acceptance criteria

• Dry-run and applied qualification can select TestPyPI using an explicit CLI option.
• Local adapters and hosted dispatch instructions receive the same closed source contract.
• Resuming a campaign with a different source is rejected as an identity mismatch.
• TestPyPI propagation uses the existing bounded retry behavior.
• Default behavior remains production PyPI and existing campaigns remain readable as that default.
• Tests cover source parsing, identity binding, local command construction, hosted markers, resume mismatch, and redaction.
• Release qualification and PyPI release docs show the candidate-first sequence.

Privacy

Only the closed source identifier may be stored or uploaded. Do not accept or emit index credentials, arbitrary URLs, source, diffs, transcripts, raw output, auth output, secrets, or local paths.

[jeffhuber]

Opened PR #723: #723

Head SHA: f5bc0fd7bc6d8a4f6d56a04d53b981f7cb6601ad