fix(ci): realign release contracts with the confluent/watsonx bundle changes (#14625)

#14612 bumped the root `lfx-ibm` floor to >=0.2.0 and added `lfx-confluent`
to the `[bundles]` extra, but the checked-in release contracts still described
the previous state. `scripts/ci` only runs when `scripts/ci/**` changes, so the
guard never ran on that PR — it went red for every later PR that happened to
touch those paths instead.

Realign the contracts with what the application actually declares:

- `bundle_profiles.json` + regenerated `enterprise-hardened.lock.json` carry the
  `lfx-ibm>=0.2.0,<1.0.0` range from `pyproject.toml`
- `release_inventory_contract.json` registers `lfx-confluent` as an opt-in
  standalone extension: forbidden in `python-default`, required in `python-full`,
  and present in the full profile's `langflow.extensions` entry points
- `test_release_inventory.py` tracks it in `OPT_IN_STANDALONE_EXTENSIONS`

Also widen the workflow trigger so a bundle change trips this guard on its own
PR: the root `pyproject.toml`, per-bundle `pyproject.toml` files, and long-tail
bundle package roots are exactly the inputs these contracts describe.