[CO-2a] chore: stage civiccore v0.22.1 attested baseline

[scottconverse]

Summary

• stages CivicCore v0.22.1 as the first Sigstore-attested baseline release candidate
• bumps package/test/docs versions from 0.22.0 to 0.22.1 where the current release line is described
• moves the release-provenance helper, attestation schema, workflow, and historical disclosure draft work from Unreleased into the 0.22.1 changelog entry
• adds the auditor-requested runbook notes for verbatim PR review paths and final historical-disclosure publication rename
• adds committed browser QA evidence for the docs/index.html release-staging copy

Release-Class Boundary

Staging only. This PR does not create a tag, publish a GitHub Release, generate a real-release attestation, upload release assets, or edit any existing release notes. The actual v0.22.1 release remains a separate per-release authorization step after this PR is reviewed and merged.

Review Surface

Copied from git diff --name-only origin/main...HEAD after the QA evidence fix:

• CHANGELOG.md
• README.md
• civiccore/__init__.py
• docs/browser-qa-v0221-desktop.png
• docs/browser-qa-v0221-mobile.png
• docs/browser-qa-v0221-summary.md
• docs/index.html
• docs/ops/release-signing.md
• pyproject.toml
• tests/test_smoke.py

Browser QA Evidence

• Summary: docs/browser-qa-v0221-summary.md
• Desktop 1280x900 screenshot: docs/browser-qa-v0221-desktop.png
• Mobile 390x844 screenshot: docs/browser-qa-v0221-mobile.png
• Browser console/page errors: none
• Horizontal overflow: false at both desktop and 390px mobile
• Copy checks: title/install/status all include v0.22.1
• Accessibility checks: body contrast 15.26, link contrast 6.83, keyboard tab reaches all documented links, empty image alt count 0

Verification

• bash scripts/verify-release.sh -> 247 pytest passed, ruff passed, version lockstep passed, release-provenance fixtures passed, required docs present, build artifacts generated, clean virtualenv import smoke passed, VERIFY-RELEASE: PASSED