release: harden DRIFT v1.0.1

[tuzuminami]

Release hardening

• require operation scopes plus owner or exact-resource delegation across scenario and session operations
• fail closed when a public handler or production runtime lacks an external authentication adapter
• preserve resource ownership through PostgreSQL hydration and cover it with an integration test
• reject invalid NODE_ENV values, redact owner IDs from public responses, and bound external-auth execution
• add immutable release evidence: package smoke test, checksum, CycloneDX SBOM, provenance, GitHub attestations, and protected publishing

Verification

• npm run check (51 passing; PostgreSQL integration is run by CI with its service container)
• pnpm audit --prod --audit-level=high
• npm run prepare:release-assets -- --output-dir <tmp> plus SHA-256 and SBOM validation
• YAML syntax validation for CI and release workflow

Closes #7
Closes #15
Closes #20
Closes #24
Closes #25
Closes #30