Prove release promotion with real signing and protected authority

[rldyourmnd]

Parent: #127.

release-promotion-gate.yml remains typed blocked. Its static verifier is exercised, but honest runtime proof requires authority that a branch fixture cannot safely invent.

Acceptance criteria:

• use a GitHub-verified maintainer signing identity and an exact numeric signed tag
• use a dedicated private control-plane evidence source with least-privilege read authority
• exercise the real protected release environment authorization and exact promotion record
• do not bypass, dry-run, skip, or substitute any required internal job
• keep credentials scoped to the disposable harness and record observable cleanup where state is reversible
• retain negative verifier fixtures and update runtime proof only from a real successful workflow_call run