Make unified release receipts reproducible - #48

Summary

• require crates.io trusted publishing and remove the one-time bootstrap path
• make Python wheel timestamps deterministic from the immutable source revision
• publish Rust runtimes first, then package the main crate against their registry checksums
• upload a publisher-produced seven-crate receipt for release finalization

Verification

• Go, Rust, Python, and TypeScript suites pass
• release, packaging, and release-control tests pass
• two delayed builds produced an identical six-wheel set
• normalized runtime archives reproduce live crates.io checksums
• registry-resolved main packaging reproduces the live yieldskill checksum