ci: publish verified SDK GitHub releases

[k1a11220]

Summary

• split public SDK GitHub Release automation from TAG2/u64 runtime work
• expose one stable required CI gate and attest exact main-branch wheel/sdist bytes
• publish only an annotated tag whose exact main SHA already has successful CI, provenance, and immutable artifacts
• publish GitHub Release assets only; no PyPI path or token

Why

Runtime protocol changes and release infrastructure must be reviewed independently. This PR contains no TAG2 parser/session implementation.

Verification

• full SDK suite: 442 passed, 10 hardware tests deselected
• release policy: 11 passed
• wheel/sdist build passed
• workflow YAML, actionlint, compileall, and diff checks passed

Not included

• TAG2/u64 runtime or firmware support
• repository protection/environment mutations
• a tag or public release