Harden the release pipeline: provenance, dry-run, pack-contents check

[andrew-jon-p7a]

Three guard rails added to .github/workflows/release.yml so the
next git tag v… && git push ships with stronger supply-chain
guarantees and fewer surprises.

Provenance

• Added id-token: write permission to the release job and --provenance to the pnpm publish invocation. The npm registry now attaches a signed attestation linking each published tarball to this exact GitHub commit; consumers see a "Provenance" badge on the package page.

Manual rehearsal

• Added workflow_dispatch trigger with an optional version input (default 0.0.0-rehearsal). Running the workflow manually executes the full pipeline (install / version-stamp / lint / build / typecheck / test / pack-verify) but skips both the publish and the GitHub Release steps. Use it to sanity-check a release would succeed before committing the tag.
• Version-stamp step branches on github.event_name: tag drives the version on real pushes, the input drives it on manual runs.
• Publish step + GH Release step are now gated if: github.event_name == 'push'. A dispatch run cannot accidentally publish.

Pack-contents verification

• New scripts/verify-pack-contents.mjs (~160 lines, no deps). Discovers every non-private workspace package, runs pnpm pack, walks the resulting tarball, and verifies every relative path declared by exports (incl. nested condition objects), main, module, types, and bin actually ships in the tarball.
• Wired into the release workflow as a step before publish, so any future change that drops a file from the published artifact (e.g. a removed entry in files, a moved source path) fails the release loud — never silently in npm.
• Verified clean against the current monorepo:
  @agentc7/ac7: OK (2 paths)
  @agentc7/cli: OK (1 path)
  @agentc7/core: OK (2 paths)
  @agentc7/sdk: OK (10 paths)
  @agentc7/web-shell: OK (2 paths)
  @agentc7/server: OK (4 paths)