test: close 1.3.2 terminal release gates

[andrei-hasna]

Summary

• make the primary Bun test gate run every discovered test file in one process, scrub active configuration inputs, and restore inherited environment state exactly
• add a manual, main-only signed evidence workflow for the already-published @hasna/emails@1.3.2 registry tarball, including live source-commit and successful-CI association checks
• require explicit Docker platform propagation plus actual Bun process.arch verification and metadata-spoof regressions
• make no-cloud, workflow, changelog, and deployment-mode ratchets fail closed without raising ceilings or adding corpus exemptions

Verification

• shared test gate: 2,528 pass, 138 skip, 0 fail across all 228 discovered files
• isolated diagnostic: 228/228 files passed
• mode-axis raw corpus: 242 <= 242; no transform/exemption
• no-cloud source gate: 26 pass, 0 fail
• TypeScript noEmit, self-host SDK types, full build, generated SDK drift, AWS static contract, and pinned actionlint passed
• PostgreSQL 16.4 matrix: 101 pass, 1 intentional missing prod-dump skip, 0 fail; attachment inventory 28 pass, 0 fail
• final follow-up package: SHA-256 98671d542ae494947d40253664b6d676f9a9992b081e38df730cb54ae363b7b4; fresh CLI/import smoke passed
• exact-range and staged gitleaks: no findings
• two independent terminal reviews: guard review GO for exact head c96011b85138745e67c9c11dd553c8542e04bb7d; release-evidence review GO with only documented local-candidate limitations

Operational boundary

@hasna/emails@1.3.2 was already published from merge fe61a466a28115f33efda1ecc7632dbc7c6525c7. This PR does not publish a package, push an image, or deploy anything. After merge, the manual provenance workflow will be dispatched once to create and verify a signed post-publication evidence attestation for the existing npm tarball.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}