ci: attest enforced repository controls in releases

[loadingalias]

What changed

• Codify the active protect-main ruleset as reviewed repository policy.
• Fail maintainer release tagging when the live ruleset or effective default-branch rules drift from that policy.
• Capture, checksum, attest, and publish repository-control evidence with each GitHub release.
• Record GitHub workflow-token bypass redaction explicitly instead of overstating what the release job can verify.
• Upgrade the dev-only libcrux ML-KEM oracle to 0.0.10, removing newly advised libcrux releases from the locked graph without suppressions.

Why

This closes the implementation side of roadmap T0.1: protected-main enforcement is reproducible, checked before tagging, and retained as release evidence. The task remains open until the first tagged release publishes and verifies the artifact.

No production cryptographic implementation or public API changed.

Validation

• Direct and force pushes to main rejected by the live ruleset.
• just check-repository-controls
• just check-actions
• just check-all
• just test --all — 1,717 tests and 163 doctests passed.
• just check
• cargo deny check all
• cargo test --all-features --test mlkem_types
• Normal light pre-push gate, including cargo-rail unification and release-intent coverage.