fix: close release readiness gaps

[ice-black-tea]

This draft PR closes the release-readiness gaps found on master@8637a8ef.

• fail closed on invalid ancestor AI workspace configuration
• declare AI runtime dependencies required by shipped CLI/config paths
• verify built candidate wheels with dependencies, imports, CLI entry points, and AI sqlite reopen
• freeze a deterministic release commit and version tag before any package publication
• atomically push master + tag; no force push
• archive the exact verified dist set plus SHA-256 manifest in a draft GitHub Release before PyPI
• resume interrupted releases only from the original release tag and archived bytes
• verify any existing PyPI files are byte-identical before using skip-existing
• serialize concurrent publication attempts for the same version
• publish the GitHub Release only after PyPI succeeds
• classify rc versions as prereleases
• refresh root/core/common/mobile/cntr/ai README files for current Python requirements, install surfaces, CLI names, and release examples

Validation: Python checks run 35718552217 passed 12/12 on merge ref 2f4213f (head 61fea89 into master 16f0c75). The publish workflow itself has not been dispatched because doing so would perform release-side effects.