Gate immutable GitHub releases on full CI and CodeQL

[harshitethic]

Why

The 0.1.3 lease-expiry fix is tested and merged, but publishing it should be repeatable and tied to the exact verified commit.

Behavior

• Make CodeQL reusable within the existing CI dependency graph while retaining the weekly scan.
• On this repository's main push only, publish a new stable version after all Python 3.11–3.13 test/packaging, benchmark smoke, lint and CodeQL jobs succeed.
• Require matching package/project versions, nonempty matching changelog notes and the tested main SHA.
• Never overwrite an existing release or move a version tag. Resolve annotated tags and reject conflicting targets. Only an explicit GET 404 means absent; permission/server failures stop publication.
• Serialize publication jobs. Restrict contents:write to the release job and supply its token only to the publication step; checkout does not persist credentials.
• Publish source archives and changelog notes on GitHub only; no PyPI upload or service deployment.

Verification

All 48 tests passed on macOS/Python 3.14.7 before push (40 queue tests plus eight publication-boundary tests). The eight new tests also passed in the editing environment. Ruff, formatting, compileall and diff checks pass. API tests use synthetic fixtures; live publication remains unverified until the merged main workflow succeeds.

After green PR checks, merging this PR will publish the prepared v0.1.3 release if every main gate passes. Existing public history/tags/releases are preserved. See docs/releases.md for failure recovery and the non-atomic main-ref check limitation.