fix(ci): make release-health alerts fail observable

[abrichr]

What changed

• grants the detector the actions: read permission required by its workflow-runs API calls
• treats a missing GitHub Release as an incomplete release even when PyPI received the package
• separates safe semantic-release and existing-tag recovery commands
• reduces the scheduled backstop from eight to two runs per day while preserving immediate failed/cancelled/skipped release checks
• prevents API outages, pending CI, in-flight releases, and propagation windows from falsely closing the standing issue
• ignores draft releases, paginates compare results, and fails closed on incomplete GitHub state

Root cause

PR #283 merged before its independent review hardening commit was pushed. The merged detector could silently exit on a missing Actions permission, downgrade an incomplete GitHub publication to a warning, and close an existing issue when required provider state was unavailable.

Validation

• python scripts/check_release_health.py --self-test
• actionlint .github/workflows/release-health.yml
• ruff check and ruff format --check
• python -m py_compile scripts/check_release_health.py
• python scripts/check_release_consistency.py
• public-artifact inventory and git diff --check

This PR does not publish or dispatch a release.

[abrichr]

Coordination hold: keep building and reviewing this PR, but do not merge it until #289 lands. This is exact-SHA merge sequencing for the receipt false-success hardening, not a release freeze.

[abrichr]

#289 has landed. Please keep building/reviewing this PR, but do not merge until the exact-main v1.25.1 patch candidate is published and independently verified. This is a short release-candidate guard to prevent an unrelated feat/fix from changing the authorized semantic version, not a broad release freeze.

[abrichr]

Release sequencing update: v1.25.1 has been published and independently verified (tag/release commit lineage, GitHub/PyPI byte-identical artifacts, archive boundary checks, and both attestations). The temporary publication hold is lifted; resume normal review and merge sequencing from current main.