ci: bind launcher releases to the release app

[abrichr]

What changes

The launcher release App can create one annotated tag from the exact protected main commit. It can't push a version commit or any other commit to main.

• A maintainer first merges the reviewed version, changelog, lockfile, and candidate state.
• A workflow_dispatch job in release-identity checks that exact state and uses the repository-scoped openadapt-release App token to push v<version>.
• The protected tag run checks the App actor, source boundary, version, changelog, lockfile, tag target, and protected-main ancestry before it builds.
• PyPI publication uses Trusted Publishing in the pypi environment. No PyPI token remains.
• GitHub and PyPI files must match the attested build byte for byte. A rerun uses the same tag and overwrites only the matching GitHub release assets.
• The workflow retains a generated platform manifest for a reviewed follow-up instead of pushing a reconciliation commit to main.

The current notify-docs.yml sender and DOCS_DISPATCH_TOKEN stay unchanged. Their cutover needs the Docs App dispatcher to exist first.

Validation

• Full test suite: 195 passed, 6 skipped
• Focused release and policy tests: 107 passed
• actionlint: passed
• Ruff: passed
• Public source-boundary check: passed
• Wheel and source archive build plus artifact verification: passed

Required settings

This draft does not create or change live settings. Before the workflow can run, the repository needs the selected-repository openadapt-release App, OPENADAPT_RELEASE_APP_ID, OPENADAPT_RELEASE_APP_PRIVATE_KEY, the founder-reviewed release-identity environment for main, the protected pypi environment for v*, the PyPI Trusted Publisher, and the release-App tag-ruleset bypass.