锁卷归位，双流复明 · Restore model metadata gates

[eric8810]

Summary

• package the deterministic locked Small model archive before Core creates model-bound release metadata
• mark WebGPU native metadata generation as model-free, matching the native npm package topology
• add workflow contract tests for both invariants

Root cause

Core generated a model directory but not the locked tarball required by generate_release_metadata.py. WebGPU native packages omitted --model-free, so their metadata generation incorrectly required that tarball. Compilation, Core tests, WebGPU tests, Electron smoke, and OCR checks had already passed before the metadata step failed.

Verification

• python3 -m unittest tests.python.test_ci_workflow_contracts tests.python.test_npm_release tests.python.test_npm_webgpu_release
• both changed workflows parse as YAML
• python3 tools/package_model_bundle.py reproduces the locked 31,334,400-byte archive with SHA-256 e543b93b…8712f
• git diff --check