ci: add CivicCore cleanroom release rehearsal

[scottconverse]

Summary

• adds manual direct-pip cleanroom rehearsal for the published CivicCore v1.2.0 wheel
• changes tag releases to draft-first, rehearse the uploaded wheel from the draft release, then publish
• adds Rev. 2 shared-host safeguards: per-repo concurrency, runner-temp caches, scoped Docker cleanup, and always-run cleanup
• fixes release-note variable export and adds the required cleanroom annotation for future releases
• updates the workflow contract test for the new draft-release and cleanroom gate shape

Verification

• git diff --check
• YAML parsed and asserted for cleanroom jobs, concurrency, cleanup traps, scoped cache behavior, and annotation text
• python -m pytest tests/test_github_workflows.py -q -> 5 passed
• bash scripts/verify-release.sh -> VERIFY-RELEASE: PASSED (284 tests passed; fresh virtualenv install proof passed)

Manual workflow_dispatch cleanroom run against v1.2.0 will be triggered after PR creation.

[scottconverse]

Cleanroom rehearsal: PASSED in workflow run 26383911757.
Verified clean install of https://github.com/CivicSuite/civiccore/releases/download/v1.2.0/civiccore-1.2.0-py3-none-any.whl from cold caches at 2026-05-25T04:53:59Z.