fix(release): make scheduling-kit BCR-only

[Jess Sullivan (Jesssullivan)]

Summary

• remove the active package-provider publish workflow and provider permissions/coordinates
• keep the shared package lane GF validation-only and move the PostgreSQL concurrency proof from hosted service containers to the locked GF devShell
• make Bzlmod/BCR the sole delivery authority across AGENTS, module/build comments, metadata guards, generated docs, and package delivery metadata
• retain internal Node, pnpm, npm_package, and Bazel artifact mechanics

Validation

• no local tests, builds, Bazel, Nix, or dev servers were run; the remote GF workflow is the only execution gate
• existing v0.11.1 tag/source receipt and append-only BCR entry are unchanged
• signed commit: e52bcf140339b34f225fae65ce609583adeaaf0d