B01: CI guardrails and first release readiness

Pin workflow tools to verified immutable SHAs with least-privilege permissions, verify the secret and workflow-lint regression fixtures with positive and negative proof, and verify package completeness from an immutable commit after approved delivery. A tag or release happens after the block closes. A release candidate is recommended until real integration exists; version stays undecided pending human SemVer migration review.