ci: block premature release PR merges

[Tom409114]

Summary

• run release readiness from trusted default-branch code via a read-only pull_request_target workflow
• require exact bootstrap/trusted-publishing/tag-policy switches and the full reviewed npm integrity contract
• repeat the exact switches in the coordinator and tag-bound publisher
• add isolated identity, repository, fork, variable, contract, and CLI boundary tests

Verification

• 626 passed, 6 skipped
• typecheck and Biome clean
• actionlint 1.7.12 passes release-readiness.yml
• independent review: Ready

Post-merge administration

The new exact check context must be added to main ruleset 21964571, then PR #66 must demonstrate a failing required readiness check while the three publication prerequisites remain safely closed.