ci: run the gates before publishing to PyPI

Only 1 of 38 release workflows in this fleet ran tests before publishing. Every
gate written for these connectors - the coverage contract, the drift direction,
the audit assertion - protected nothing at release time: a broken commit, once
tagged, went straight to PyPI. The gates only held on a developer's laptop.

Smoke tests are deselected on purpose. They call live upstream sources, and an
outage at a government portal is not a reason to block our release. The
deterministic gates are.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>