feat: Phase E E4 safety-release decision schema - #1018

Summary

• Adds SRD- safety-release decision schema (src/openamp_foundry/evidence/safety_release_decision.py)
• Makes external release authorization machine-checkable: every release must reference an SRD- record
• Enforces three required safety checks (dual_use_screened, dry_lab_only_label_present, novelty_claims_bounded) before "authorized" status
• 58 tests across constants, build happy paths, validate rejections, and format; BASELINE updated 10764→10822

Design

• VALID_SRD_DECISIONS: authorized / rejected / pending_review
• VALID_RELEASE_SCOPES: academic_collaboration / public_preprint / internal_only / restricted_partner
• REQUIRED_SAFETY_CHECKS: 3-check gate that must all pass for "authorized"
• all_required_checks_passed auto-computed; authorized decision blocked if gate fails
• rejected requires non-empty rejection_reason
• dry_lab_only=True always enforced; limitations must be non-empty

Safety

• Does not weaken any existing safeguard
• Adds a new gate preventing unchecked external release
• Marks E4 complete in NEXT_100_PR_MAP.md

Test plan

• 58 unit tests pass
• BASELINE regression test passes (10822)
• make agent-check