release: prepare CivicClerk v1.0.4

[scottconverse]

Summary

• Prepare CivicClerk v1.0.4 after the Persistence Phase 1 merge.
• Move release, preflight, and cleanroom workflows to GitHub-hosted ubuntu-latest runners and set up Node 22 before release verification.
• Refresh v1.0.4 docs, API spec, release evidence screenshots, helper defaults, and release contract tests.
• Anchor path-invoked release/readiness scripts to the checkout source so local scripts do not import a stale installed package during release validation.

Validation

• python -m pytest -> 668 passed under the local PowerShell Python environment with the CivicCore suite-session override.
• python -m pytest tests\test_milestone_12_release.py tests\test_milestone_11_accessibility_browser_qa.py tests\test_github_workflows.py -> 18 passed.
• python scripts\verify-browser-qa.py -> passed.
• bash scripts/verify-docs.sh -> passed.
• python scripts\verify-recovery-gates.py -> passed.
• bash scripts/verify-release.sh -> VERIFY-RELEASE: PASSED, including Python 3.14 pytest, docs/recovery/security/placeholder gates, browser QA, frontend install/audit/build/tests, Playwright user flows, wheel/sdist build, checksums, runtime install proof, and release contract tests.

Release Notes

• This PR does not create the v1.0.4 tag. Tagging should happen only after this prep PR is green and merged into main.