ci: bind Capture releases to admitted artifacts

[abrichr]

Outcome

This stacks on #82 and makes Capture publication an exact-artifact, fail-closed transaction.

Changes

• Split release preparation from publication. Preparation creates a version commit without a tag or package and dispatches exact-commit native qualification.
• Build one wheel and one source archive in qualification. Install or publish only those retained bytes.
• Require clean-wheel checks on Linux, macOS, and Windows; authenticated control checks on macOS and Windows; and interactive no-skip qualification on Linux, macOS, and Windows.
• Require live Linux window move/resize and live Windows UIA, macOS Accessibility, and Linux AT-SPI structural evidence.
• Isolate the PyPI identity token in a minimal job. Keep SHA256SUMS outside the PyPI package directory.
• Verify exact version-scoped PyPI parity. Emit an attested not_admitted candidate. PyPI latest does not select Production.
• Keep the central OpenAdaptAI/.github signed admission ledger as the only Production authority.
• Remove static Experimental, Beta, and Pre-Alpha package labels. Describe Capture as the stable canonical native recorder, with release-specific admission.

Local verification

• actionlint: pass
• release contract tests: 26 passed
• full tests except the repository-only browser bridge: 485 passed, 10 skipped
• scoped ruff: pass
• wheel and source archive build: pass
• distribution verification: pass
• public source-boundary check: pass

Draft dependencies

• feat: complete native Capture producer contracts #82 must merge first. This pull request is based on its exact head so the Linux extra and all three structural producers are present.
• The central lifecycle policy, ledger activation path, and exact Evals evidence authority must merge before release activation.
• The labeled interactive Linux, macOS, and Windows qualification jobs must pass with no skips on the prepared version commit.
• A release remains not admitted until the central signed, current, unexpired, unrevoked ledger entry selects its exact source commit and PyPI artifacts.

This pull request does not publish a package, create a release, or change a Production default.