feat(infra): add exact-SHA CI and release evidence

[CJianYu]

What Problem This Solves

Shiploop had strong local diff-bound proof and guarded merges, but CI routing was duplicated across jobs and release publication rebuilt trust from mutable workflow state instead of one immutable artifact identity.

Why This Change Was Made

This adopts the reusable parts of OpenClaw's infrastructure model without copying its repository-specific workflow sprawl: one exact-SHA preflight manifest, richer evidence identity, and a validate-then-publish release chain.

User Impact

• New shiploop ci plan --base <ref> --head <ref> --json command.
• Evidence can record GitHub run ID, attempt, check name, and artifact SHA-256.
• New shiploop release manifest and shiploop release verify commands.
• Docs-only changes can skip code lanes while one stable ci-gate remains available for branch protection.

Risk

CI and release workflows are high-risk. Third-party Actions are pinned to full SHAs, checkout credentials are not persisted, publication permissions exist only on the environment-gated publish job, and the exact validated tarball is verified again before npm publication.

Proof

• npm run check
• 53 tests pass
• npm run build
• npm pack --dry-run
• Actionlint v1.7.12
• Shiploop diff-bound proof
• Deep review of workflow permissions, SHA binding, rename handling, and failure behavior