Harden synchronized launcher publication

[fruwe]

Summary

• pin every third-party workflow action to an immutable commit with its reviewed release comment
• add one shared fail-closed preflight for stable tag grammar and synchronized Python, Rust, Node, and lockfile versions
• keep manual release dispatch crates-only while requiring the same package-coherence validation
• protect the five CI job contexts and required runtime/toolchain versions with a repository check

Validation

• Family Connection/Context v1 vectors: 163 passed on Python 3.13 with hash-pinned dependencies
• Python 3.11: Ruff passed; 195 tests passed
• Rust stable: release build, clippy with warnings denied, default tests, and repository fixture vectors passed
• Rust 1.81: release build, default tests, and repository fixture vectors passed
• Node 22: launcher and Family Connection/Context tests passed
• release verifier: matching tag/manual paths passed; malformed stable tags and all cross-package mismatch positions rejected
• workflow YAML parsing, immutable-pin/context check, and git diff --check passed

Scope

No launcher version, dependency, dispatch behavior, State engine behavior, tag, or publication change.

Closes #14