Reconcile the existing Forge 2.7.22 release

[pcvantol]

Scope

Adds a one-purpose protected workflow and validator to terminally reconcile the already-published Forge 2.7.22 artifacts from original source e167ddd9995ac5cd9e7765a1d338547d08df4755. It does not rebuild or upload Python distributions.

Safety

• preserves the original failed run as history
• re-downloads and byte-verifies exact PyPI artifacts
• allowlists and hashes every release asset
• binds every follow-up receipt to a real workflow run on protected main
• isolates package execution from write-capable jobs and evidence handoff
• verifies the actual peeled tag source
• supports idempotent PUBLISHED/CLEANUP_PENDING/RELEASE_COMPLETE recovery
• completes scoped cleanup before terminal evidence

Evidence

• full repository validation: 717 tests PASS
• product version and offline projection PASS
• focused release suites: 34 tests PASS
• independent Quality re-review: PASS
• independent Security re-review: PASS
• all workflow shell blocks: syntax PASS