ci: enforce release quality gates

[FreeOnePlus]

Summary

• add read-only GitHub Actions gates for lock/sync, Ruff, Mypy, Bandit, the full test suite, package build, clean-wheel smoke, and MCP conformance
• pin every third-party Action and the official MCP Conformance checkout to immutable commits
• add repository contract tests that prevent required gates, timeouts, or pinning from being removed silently

Why

The release checks were reproducible locally but were not enforced for pull requests. This makes the existing release contract visible and repeatable in GitHub Actions without exposing private Doris infrastructure or credentials.

Validation

• uv 0.9.0 lock check and frozen development sync
• Ruff: passed
• Mypy: 58 source files, no issues
• Bandit: no findings
• pytest with warnings as errors: 633 passed, 64 skipped, 0 warnings
• source distribution and wheel build: passed
• clean wheel install: both CLI smokes and package imports passed
• official MCP Conformance 0.2.0-alpha.10 at 49103de: server-stateless [2026-07-28], 25/25 passed, 0 failed, 0 warnings
• real Doris integration: 7/7 passed across Streamable HTTP and true subprocess Stdio; temporary tables/users and tunnels were cleaned