fix(release): preserve qualification and repair Linux setup

[abrichr]

What changed

A release-dispatched CI or clean-machine run now survives later activity on
main. Ordinary pull request and push runs still cancel superseded work. The
release job keeps its final current-main check, so it can't tag a stale
candidate.

Linux browser setup now checks the case-sensitive X11 sonames and prints the
remedy with the exact Python interpreter that runs Flow:
/path/to/python -m playwright install-deps chromium. It reports a later
browser-download or proxy failure as a separate error.

The source guard now verifies the rendered policy's canonical digest and
requires the openadapt-flow entry to cover every crown-jewel category. It
scans every tracked file, including files under build directories that the
normal worktree walk skips. It reads regular files through stable descriptors
and rejects links, special files, and files that change during inspection.

The wheel and sdist validator applies the canonical content patterns to every
regular archive payload. It also rejects case-colliding names, ZIP special or
encrypted entries, excessive member counts, oversized members, and excessive
expanded size.

Why

The 1.35.0 release gate needs inspectable exact-SHA CI and three-OS quickstart
results. The old concurrency group let unrelated activity on main cancel a
qualification run while the release job waited for it.

The advertised Linux setup also failed before the browser download because four
installed X11 libraries were queried with the wrong case. After that probe is
fixed, a blocked Playwright CDN is correctly reported as a later environmental
failure.

The release boundary must enforce the canonical source policy on both tracked
source and built archives. A renamed or build-excluded private artifact must
not pass because its path looks harmless.

Checks

• 117 focused onboarding and release tests passed; 4 platform tests skipped
• 87 focused source-policy and archive-contract tests passed
• Ruff lint and format checks passed
• Mypy passed for the release guard
• Workflow YAML parsed successfully
• Release consistency check passed
• The 1.35.0 wheel and sdist rebuilt and passed the strengthened archive guard

Opened by an agent session, not the founder.

[abrichr]

Closing this task-owned pull request because another active context now owns the Linux correction in #460. This branch remains intact. Its independent release-orchestration and source-boundary work will be separated locally and will not modify #460.\n\nClosed by an agent session, not the founder.