ci: install and verify exact Python release artifacts

[imran-siddique]

Summary

Gate PyPI publication on installing and exercising both exact artifacts to be uploaded: the wheel and source distribution. Each is installed in a separate clean environment and tested outside the checkout. Release tags must match package metadata.

The smoke test checks distribution/runtime version agreement, import provenance for both cmcp_runtime and cmcp_verify, core configuration construction, and the installed cmcp console entry point. Twine metadata validation is also part of the build job.

Root cause

The previous workflow built archives and immediately uploaded them. Source-tree CI could not detect packaging omissions, stale build contents, broken console scripts, install-time dependency failures, or a release tag that disagreed with package metadata.

Validation

• Built the 0.4.0 wheel and sdist
• Validated both with current Twine 7
• Installed each artifact into a separate clean environment
• Ran provenance/version/configuration smoke checks outside the checkout
• Invoked the installed CLI for both artifacts
• Added a focused smoke-script regression test
• Full clean-environment suite: 1051 passed, 8 skipped
• Ruff and mypy: clean
• git diff --check: clean

Documentation

• Documented the artifact gate in CONTRIBUTING
• Added an Unreleased security changelog entry