feat: Phase E E8 release-summary generator

[cschanhniem]

Summary

• Adds RSM- release-summary schema + generator (src/openamp_foundry/evidence/release_summary.py)
• RESTRICTED_FIELDS tuple enumerates what must never appear in public summaries (erp_id, rejection_reason, candidate_ids, raw_sequences, reviewer_ids, etc.)
• strip_restricted_fields() utility removes restricted keys from any source dict
• generate_release_summary() validates source_fields for restricted keys before building — accidental leakage is caught at generation time, not discovered in the wild
• 74 tests; BASELINE updated 10822→10896; E8 marked complete in NEXT_100_PR_MAP.md

Design

• restricted_fields_stripped=True and dry_lab_only=True always enforced
• candidate_count replaces individual IDs — no candidate-level identifiers in public summary
• safety_checks_summary carries check names only, no pass/fail details
• limitations_summary is a required non-empty string — no silent omission of caveats

Safety

• Directly complements E4 SRD- authorization schema — release requires authorization + stripping
• Does not weaken any existing safeguard; adds a new leakage-detection layer
• Marks E8 complete in NEXT_100_PR_MAP.md

Test plan

• 74 unit tests pass (constants, build, validate, strip, generate, format)
• BASELINE regression test passes (10896)