[v0.17 REL-CI] Generate and drive the release graph with authenticated receipts

[TheGreenCedar]

Package REL-CI in the v0.17.0 consolidated remediation program.

Contract

Deliver W8.2, W8.3, W8.5, H-1, H-5, and S1 as the release-control package: stable-only entrypoints; latest-attempt rerun selection with per-id tolerance; protected-runner heartbeat/reservation and typed pre-assignment non-claim; retire the dead ARM64 Linux lane and add the unpinned Linux quality smoke; implement the release driver receipt; and generate workflow_policy from one declarative graph.

Dependencies

All workflow point fixes and final proof-floor semantics.

Program boundaries

• The implementation PR uses a codex/* branch, targets dev/codestory-next, and carries this issue as Closes #N.
• Keep source, package, protected-host, installed-runtime, and publication proof distinct.
• Preserve atomic old-or-new publication, pinned readers, crash recovery, content-verified freshness, fail-closed evidence, observational status/doctor, accelerated embedding without CPU fallback, proof-owned cleanup, and serial Cargo execution.
• Do not touch product version surfaces. The release lane owns the single synchronized version change after implementation is integrated.
• Run focused proof while iterating and the owning path gate on the accepted candidate; broad source proof remains once on the frozen release candidate.

Done when

One artifact-pipeline change has one graph owner; the driver records exact commits, trees, runs, attempts, artifacts, digests, approvals, invalidations, and next action; lost/unavailable hosts remain typed without masking assertion failures.

Refs #1233
Refs #1179