ci: bind current evidence inputs

[abrichr]

Summary

• Bind the current Flow evidence to exact verifier scripts, retained result artifacts, runtime dependencies, and task/oracle contracts.
• Fail the existing low-cost freshness guard when any bound input changes.
• Retain the scheduled PyPI release check. This change adds no benchmark matrix or dependency install.

Validation

• Offline freshness check passed.
• Current-version freshness check passed for Flow 1.28.0 and its published wheel digest.
• Ruff passed for the changed script and test.
• The focused pytest command is blocked locally because this worktree has no installed openadapt_types dependency.