fix: attest immutable release tags

[jinyounghub]

What changed

• Replace the impossible GITHUB_TOKEN call to the admin-only immutable-releases endpoint with a repository administrator attestation scoped to the exact tag.
• Keep the post-publication immutable: true and exact 16-asset verification unchanged.
• Reject a mutable already-public release before a resumed NuGet publish, and require the verified release to be the repository's latest release before success.
• Add a maintainer release runbook covering the admin preflight, tag attestation, NuGet OIDC, Marketplace draft window, and post-release checks.
• Advance the synchronized install, Action, documentation, issue-template, and lockfile contract to 0.2.3.

Why

The v0.2.2 workflow successfully assembled the complete 16-asset release contract, then safely stopped before draft creation because GitHub's immutable-release settings endpoint requires repository Administration: read. That permission is not available in the workflow permissions: surface for GITHUB_TOKEN, so the integration correctly returned HTTP 403 even though the administrator-authenticated endpoint confirms immutable releases are enabled.

The replacement gate records a point-in-time administrator check for the exact version tag before a draft can be staged, and the workflow asserts immutable: true again after publication. Future tags cannot reuse a prior attestation; the runbook requires setting it immediately before the tag is pushed and leaving immutable releases enabled until the workflow finishes.

Validation

• Version, workflow contract, and PowerShell AST safety checks
• Locked restore with .NET SDK 10.0.302
• Release build: 0 warnings, 0 errors
• Tests: 29 passed
• NuGet pack and reproducible normalization
• Installed-tool smoke: version, report metadata, and exit codes 0/1/2
• PR CI includes the six-platform native contract and clean-extracted native SBOM path