release: bind Ares to GhostMCP 0.2.1

[jason-allen-oneal]

Summary

• advance the vendored GhostMCP commit and the ghostmcp extra to the merged 0.2.1 release identity
• require a release-tag commit to be reachable from protected main
• pin every external action in the release workflow to an immutable commit
• verify tag identity and protected-main ancestry in a contents-read prerequisite before any write/OIDC-capable release job starts
• keep PyPI publication behind the existing repository variable and reviewed pypi environment
• avoid a pytest module-name collision between the Ares and vendored GhostMCP release tests

Release boundary

GhostMCP 0.2.1 is merged and green on BlueDot-IT/GhostMCP main, but its tag and PyPI publication remain intentionally pending Trusted Publisher configuration. This PR does not create a tag, enable PYPI_PUBLISH_ENABLED, or publish either package.

Verification

• exact head: ccfebf0f7500e6c7a409dac1c19bd6e906e10355
• complete isolated suite: 495 passed, 1 skipped, 11 subtests passed
• focused release/GhostMCP suite: 17 passed
• critical Ruff selectors and git diff --check: passed
• wheel and sdist build: passed
• twine check dist/*: passed
• wheel contains the Evaluation Lab fixture and expected metadata/entry points

All Ares tests used a temporary APP_HOME; live ~/.ares state was not used.