汰繁留真，契约归途 · Streamline release test contracts

[eric8810]

Summary

• separate npm and WebGPU release scenarios from reusable fixture builders
• remove redundant or obsolete policy tests and replace CMake source-text checks with behavior validation
• enforce WebGPU provenance in the production packager and cover unsafe dependency archives
• include the split WebGPU npm suite in dedicated CI and its developer documentation

Verification

• python3 -m compileall -q tools tests/python
• python3 -m unittest discover -s tests/python -p test_*.py — 69 tests passed
• git diff --check

Checklist

• The change is focused; relevant tests were added or updated when behavior changed, otherwise this is N/A.
• Documentation and CHANGELOG.md were updated for user-visible changes, otherwise this is N/A.
• No credentials, private OCR inputs, generated build trees, or unrelated artifacts are included.