ci: verify release ancestry before privileged jobs

[jason-allen-oneal]

Summary

• add an unprivileged contents: read tag-verification job before any release job receives write or OIDC authority
• verify protected-main ancestry before reading package metadata and matching the tag to the package version
• disable checkout credential persistence in both verification and privileged release jobs
• keep PyPI publication transitively gated behind the verified release job
• add release-metadata tests for permissions, action pinning, ordering, credentials, and job dependencies

Security rationale

The existing workflow checked tag identity and main ancestry only after GitHub had already issued a write/OIDC-capable job token and checkout had persisted its credential. This change moves the trust decision ahead of privileged-token issuance.

Verification

Exact head: f05a0ca1b1ecbefc7020442344024b204632d099

• focused release tests: 3 passed
• full suite: 91 passed, 1 expected E2E skip
• valid main/tag accepted; wrong-version and non-main targets rejected
• actionlint v1.7.7: passed
• Ruff 0.15.17: passed
• YAML trust-graph parse: passed
• exact-commit archive build with the hashed Python 3.11 release lock: wheel and sdist built
• Twine: wheel and sdist passed
• git diff --check: passed
• independent release-bypass review: no findings

No tag or release is created by this PR.