chore: enforce strict release gates and CI orchestration

[satishskid]

What this PR does

• Adds CI build gate workflow for PR/main.
• Adds strict release-gate workflow for main/manual dispatch.
• Adds single-command release orchestrator (npm run release:orchestrate) with hard pass/fail checks.
• Adds release orchestration contract docs and updates readiness checklist.
• Adds artifacts hygiene (reports, .playwright-cli) to .gitignore.

Gates enforced

• Build succeeds.
• Readiness check succeeds (0 critical failures).
• Session CRUD smoke (create -> update -> delete) succeeds.
• Deployed RBAC bundle contains expected coordinator emails and excludes QA markers.

Required repo config

• Secret: ADMIN_API_TOKEN
• Variables: DEEPLEARN_API_BASE_URL, DEEPLEARN_PAGES_BASE_URL, EXPECTED_COORDINATOR_EMAILS, DISALLOWED_EMAIL_MARKERS

Notes

• Main branch protection requiring checks Build / build and Release Gate / gate has been enabled.