Complete distribution and release hardening

[KeyffMS]

Summary

Completes the non-Codex release-engineering work so the remaining production blockers are repository administration and live Codex qualification.

Distribution

• add standard-library install / verify / upgrade / status / uninstall tooling;
• preserve existing AGENTS.md, compatible .codex/config.toml, unrelated hooks and adopted files;
• track ownership/hashes in .plananvil/installation.json;
• fail closed on unmanaged conflicts and locally modified managed files;
• transactional rollback on failed mutations.

Release engineering

• introduce distribution version 0.2.0 and manifest;
• add deterministic ZIP/checksum/release-notes builder;
• add candidate and production release gates;
• add tag-driven GitHub Release workflow that cannot publish until required capabilities are REPRODUCED;
• pin Actions to immutable Node-24-based SHAs.

Validation

• expand core CI to Python 3.11 and 3.14 on Ubuntu/macOS/Windows;
• add distribution and release-engineering tests;
• add deterministic C01-C16 template archive, safe materializer, validator and rehash tool;
• document installation, troubleshooting, release and the remaining Codex sandbox procedure.

Intended end state

After this PR, only two external workstreams should remain:

1. GitHub administration: protect main as tracked by issue Protect main with required PlanAnvil CI checks #6;
2. create an authenticated Codex sandbox and execute/commit the prepared live C01-C16 evidence as tracked by issue Complete live Codex capability evidence for baseline 2.3 #7.