ci: split PR and release certification gates

[jmagly]

Summary

Align T3MP3ST CI and maintainer-agent policy with the shared BT6/OBLITERATUS delivery model:

• use a fast PR correctness gate plus a 50% changed-executable-line coverage floor
• reserve full 100% per-file coverage, evidence, anti-fitting, smoke, build, audit, and package checks for release tags
• create one deterministic source ZIP from the tested tag
• extract, install, build, and invoke the CLI from that ZIP before retention
• record SHA-256 checksums and a keyless Sigstore provenance bundle
• synchronize contributor, maintainer, PR-template, release, and generated docsite policy

Audit result

The written contributor policy already allowed 50% changed-line coverage, but CI still ran the release-grade 100% coverage job on every PR. The agent maintainer profile also did not distinguish quick PR validation from full release certification. The previous release job retained an npm tarball instead of the requested user ZIP.

AIWG deployment health is green, and bt6-maintainer 0.2.0 matches its locked shared source.

Validation

• npm run test:changed-coverage-script: pass
• COVERAGE_BASE=upstream/main PR_CHANGED_LINE_COVERAGE=50 npm run test:pr-coverage: pass, 787 tests
• npm run test:pr: pass, 787 tests; doctor has no blockers
• npm run test:release: pass, including 100% configured coverage and all release gates
• npm audit --audit-level=high: pass, zero vulnerabilities
• workflow and maintainer YAML parse: pass
• npm run maintainer:check: pass
• aiwg status: healthy
• git diff --check: pass

Residual boundary

The release workflow is tag-triggered; GitHub-hosted attestation and clean-ZIP installation are validated by the exact-head workflow after merge/tag, not emulated locally.