Automate immutable GitHub releases

[Doctacon]

Summary

• replace the paused one-off release ceremony with a reusable annotated-tag-triggered GitHub Release workflow
• keep CI and release readiness read-only while isolating write and attestation permissions to the publish job
• stage v0.6.0 public metadata and generalize exact source/distribution validation
• preserve and supersede unused manual release records

Reviewed identity

• head: 0226390
• base: develop@06708ce39e9b5e8c15ce6204c2af4e9c73334ade
• tree: 587693cd3d30d557a4436660aa480b6f3d97c5f6

Validation

• Actionlint v1.7.7: pass
• focused release automation: 24 tests pass with ResourceWarning fatal
• locked Python 3.11 and 3.13 full suites: 1,033 tests pass on each
• source, lock, ranking, C6, distribution, clean-wheel smoke, and diff hygiene: pass

This PR does not create a tag or Release, enable immutable Releases, publish to PyPI, or touch provider/user data.