fix: harden release metadata and runtime

[tensornull]

Summary

• pin Release Please to the reviewed v5.0.0 commit whose action metadata uses Node 24
• make README installation and availability text publication-neutral before and after a release
• parse and validate the actual distribution long description, require wheel and sdist metadata to exactly match the source README, and reject transient/version-specific release text
• encode the durable release boundaries in the repository documentation and add adversarial regression coverage

Root cause

Release Please remained pinned to v4.4.1, whose action metadata declares Node 20. Separately, README release state was embedded verbatim into immutable PyPI metadata, so version-specific pre/post-release edits could not repair an already published distribution. The artifact parser previously stopped at the metadata/body separator, so it could not validate the rendered long description or detect source/artifact drift.

Impact

The normal 0.1.x release path now runs the reviewed Node 24 action. Future artifacts carry durable PyPI text that is valid on both sides of publication, and release checks fail closed if source, wheel, or sdist metadata diverge.

Validation

• uv sync --locked
• Ruff check and format check
• Pyright strict
• 326 non-live tests
• version, public/releasable document, secret, workflow-semantic, and actionlint checks
• clean wheel/sdist build, Twine, artifact inspection, and exact metadata comparison
• independent wheel and sdist clean installs plus all README examples
• copied standalone-repository verification
• OpenAI 2.45.0 minimum/locked and 2.50.0 latest-within-major compatibility
• git diff --check

No live API request, tag, release, PyPI upload, recovery path, or repository administration change is part of this PR.