test: lock cleanroom release workflow contract

[scottconverse]

Summary

• Adds a workflow contract test for the release cleanroom gate.
• Locks the required workflow_dispatch release_tag input at v1.0.8.
• Asserts publish-release depends on release-cleanroom-rehearsal, scoped cleanroom labels are present, unscoped system prune is absent, and cleanroom annotation text is present.

Verification

• python -m pytest tests/test_github_workflows.py -v -> 2 passed, 1 warning.
• Mutation proof: temporarily removed publish-release.needs; python -m pytest tests/test_github_workflows.py -v failed; restored and reran to pass.
• Initial full verifier hit one pgvector runtime-search flake; exact failing test rerun passed.
• Current main baseline bash scripts/verify-release.sh -> VERIFY-RELEASE: PASSED.
• Branch rerun bash scripts/verify-release.sh -> VERIFY-RELEASE: PASSED.