feat: build hash-bound M0 publisher envelopes

[Pigbibi]

Summary

• build a closed M0 ledger envelope from one validated QAR source snapshot and immutable artifact metadata
• verify the source artifact SHA-256 and add a canonical ledger SHA-256
• default to local JSON output; outbound HTTPS delivery requires an explicit publish flag and two dedicated environment variables

Safety

• no scheduler, worker, UI, runtime, platform, strategy, broker, or execution change
• publish path rejects non-HTTPS URLs and URLs with query or userinfo
• token and URL are not written into the envelope or exception output

Validation

• python -m unittest tests.test_build_m0_research_publisher_envelope passed locally: 4 tests
• Python compile, JSON schema parse, and diff checks passed
• GitHub CI will run full regression checks