fix(release): fetch provenance history before publish

[AgentArcLab]

Summary

• fetch full Git history in the trusted-publishing workflow so the attested source commit can be verified
• make release provenance tag-state tests deterministic in an isolated repository
• lock the full-history checkout requirement with a package contract test

Root cause

The first v0.3.3 release run stopped before npm publish because the default shallow checkout did not contain the attested source commit 37eb8dd6ae8c44ea4622d39f8c7ae9b13916a793.

Verification

• npm run release:preflight -- --allow-dirty --allow-unreleased
• 271 Vitest tests passed
• 120 Node contract tests passed
• lint and all three builds passed
• 5 canonical conversation Playwright scenarios passed
• packed tarball installed and its public conversation API was verified in a clean consumer project

No npm artifact was published by the failed release run.