fix(release): publish only tested revisions

[pathscale]

The release workflow could publish a revision that had not passed CI, while the rendered QA host and driver also floated between runs. A successful CI run on master now releases only its exact tested SHA, stops if master advances, tags the exact packaged revision, and uses reviewed Bun, Chuzz, and ps-qa versions.

The repository contract now records the no-lockfile policy and the exact ps-qa release requirement.

Validation:

• native rendered component sweep with published ps-qa 0.7.3 and pinned Chuzz: 101/101
• slider outcomes: 11/11, including pointer drag, keyboard changes, and onChangeEnd
• browser-condition tests: 321 passed, 0 failed (1,135 assertions)
• QA harness lint and TypeScript typecheck
• package contract: 1,004 files and 187 component API contracts
• fresh tarball consumer install, typecheck, and browser bundle
• workflow YAML syntax and shell syntax checks

No component behavior or package version changes in this PR. Publication remains automatic after merge and successful CI; this PR does not publish or deploy anything.