Harden package publish controls

[jsugg]

Summary

• add required release gates before PyPI/TestPyPI publishing
• build distributions with uv, check metadata, smoke-test wheels, record hashes, and upload evidence artifacts
• keep production and rehearsal publishing behind explicit repository variables
• document release, rollback, and security reporting procedures