feat(release): signed managed-release pipeline and policy-enforcing CI

Lands the release slice of the managed-cloud implementation verbatim:
scripts/release/ (deterministic build/verify, signed guest-image and
offline host-package builders, tag-bound version resolution, fail-closed
CI authorization, and their tests) plus the release-artifacts workflow.

The release policy requires an exact CI job matrix, so ci.yml is reshaped
to it: the go job now tests nehemiahd, the guest agent, and the public
gateway (with govulncheck); the workspace job gains the npm audit gate,
the release policy checks, a root build, and the Postgres-backed
control-plane migration replay + full suite; the new wire-contract job
checks generated model drift (bringing scripts/openapi-models.mjs); shell
now also lints authorize-ci.sh. Two workspace steps whose slices have not
landed yet (live-harness syntax, deploy promotion policy) are deferred to
those slices. Lockfile bumps via npm audit fix satisfy the new
audit-level=high gate.

Co-authored-by: Cursor <cursoragent@cursor.com>