Establish wheel-first release gates across the supported Python and OS matrix

[codeforester]

Parent: #50

Train position: 17 of 22
Phase: P3 — Ecosystem trust

Problem

Source-tree tests and artifact checks do not yet prove the complete framework against every advertised Python/OS combination from a clean installed distribution.

Acceptance criteria

• sdist and wheel are built from a clean checkout into a clean destination with an explicit content allowlist that detects stale build artifacts.
• An isolated environment installs the wheel and runs public API and integration tests against the installation rather than the source tree.
• CI runs the full relevant suite across Python 3.10–3.14 on Linux, macOS, and Windows while retaining representative distribution and WSL validation.
• Blocking jobs enforce formatting/lint, strict typing, a coverage threshold, documentation/link/example checks, and dependency/static security checks.
• Release artifacts are the same reviewed artifacts promoted to publication.

Dependencies

• Unify production and test invocation and restore native Click option syntax #53
• Publish stable typed runtime, profile, and context extension contracts #59

[codeforester]

Carryover from #57/#79 review: add persistent minimum-supported and latest Click test lanes. The attachment adapter necessarily exercises Click 8.1-compatible internal state such as _protected_args and _exit_stack; #79 was manually verified on Click 8.1.8 and 8.4.2, while normal CI currently resolves only the latest release.