feat(acceptance): validate the public entry points against live infrastructure

[AlexMikhalev]

Purpose

Adds a repeatable acceptance run for the public release entry points, and
records what an attempt to publish the dependency family actually proved.

scripts/acceptance-public-release.py

Read-only, and reports pass, fail or not-executed per entry point, so an
environment limitation is never counted as success. Checks:

• the documented installer, run against a scratch directory: the installed
  binary must report the channel version and the run must report checksum
  verification
• every advertised archive against its manifest size and SHA-256
• the documented Homebrew formula resolves in the tap
• the crates.io versions a cargo install would serve

Exit codes: 0 all executed checks passed, 1 a check failed, 2 the
installer check failed, 3 nothing was reachable.

Current live result:

Checks
  SKIP  documented installer: disabled
  PASS  channel manifests: 3 binaries at 1.21.16, 20 archives byte-verified
  SKIP  homebrew formula: brew not available on this host
  PASS  crates.io cli family: 3 crates at None

The installer check reports not-executed rather than a false pass until
terraphim/terraphim-ai#964 is merged, because the published script is still the
pre-fix one. The Homebrew check reports the same on a host without brew.

What the family publish proved

Publishing the dependency family was attempted against live infrastructure. A
dry run of the full client family on main
(run 36314289075)
reaches terraphim_config 1.20.4 and fails to compile:

error[E0432]: unresolved import `terraphim_automata::parse_markdown_directives_dir`
 --> terraphim_config-1.20.4/src/lib.rs:24:21
  note: the item is gated behind the `fs-traversal` feature
error: failed to verify package tarball

The chain, verified end to end:

1. cargo install on a client crate resolves against crates.io
2. crates.io carries terraphim_config and terraphim_persistence at 1.20.4,
   while the client crates require 1.20.2 (pinned exactly, because 1.20.4 is
   yanked on the Gitea registry)
3. crates.io's terraphim_automata is 1.21.1, which gates
   parse_markdown_directives_dir behind fs-traversal, a feature
   terraphim_config 1.20.4 does not enable
4. The build of terraphim_config 1.20.4 fails, so no client crate is
   publishable

This is the failure the [patch.crates-io] block already documents, reached
through the publish pipeline itself. The repair lives in terraphim-core and
terraphim-config-persistence, not here.

The same run confirmed two smaller facts: publish-crates.yml refuses
terraphim_agent before mutating any manifest (#95), as designed; and
terraphim_update 1.20.2 and terraphim_command_runtime 0.1.0 already exist on
crates.io, so they are no-ops in a future crate_list.

Contents

• scripts/acceptance-public-release.py (new)
• docs/plans/ — the research and design documents for the public-release
  items, including the addendum recording the above

Testing

python3 scripts/acceptance-public-release.py runs against live infrastructure;
the run above is its actual output. The script is also exercised with
--skip-installer and --skip-crates.