Add cross-platform CI and fail-closed release publishing

[brxs]

Part of #107.

Adds the shared three-platform CI gate and restructures tag releases around explicit artifact producers plus exactly one fail-closed publisher.

What changed

• runs model-free Python, frontend, and Rust checks on macOS, Ubuntu, and Windows
• runs SA3 subprocess/output/error/timeout contracts through a cross-platform fake CLI, without MLX or weights
• keeps hardware/audio/MIDI/GPU qualification explicitly outside hosted-runner claims
• introduces a locked portable Python CI dependency group without MLX or model runtimes
• keeps macOS signing/notarization in its protected producer environment
• gives contents: write only to the single publisher job
• binds each producer bundle to the release tag and exact source revision
• verifies producer set, schema, portable filenames, sizes, SHA-256 values, checksums, and draft-upload metadata before publication
• requires GitHub's exact SHA-256 digest for every uploaded release asset
• binds creation, verification, publication, and cleanup to the draft's immutable release ID, exact tag, and source revision
• binds the publisher's required producer arguments to the complete configured producer policy
• documents how Linux and Windows become required release producers later

Verification

• 20 release/workflow contract and mutation tests
• Python: 158 service tests, 25 portable deck tests, and 19 model-free SA3/readiness tests; Ruff clean
• frontend: lint, type-check, build, and 656 tests
• Rust: 229 shell tests + 109 engine tests; Clippy clean
• Windows and Linux locked Python resolution dry-runs
• workflow YAML parsing, embedded-shell parsing, and clean diff checks

Integration dependency

This PR is intentionally draft until the parallel #107 Windows-compilation fixes are integrated: #118 (audio formats), #117 (process supervision), and the secure runtime-installer slice stacked on #115. It does not duplicate those fixes merely to make its own matrix green.

[brxs]

Superseded by and fully consolidated into #131. The combined branch includes this lane's substantive changes, subsequent integration fixes, and exact-head cross-platform validation. Please continue review in #131.