Release signed Gloss runtime with layout reuse and telemetry

[SunChJ]

Summary

• cache verified font assets and bounded layout IR work, with six-phase performance telemetry
• add a persistent DocLayout service and resilient executor event heartbeats
• preserve ISO 32000 legacy PDF compatibility while marking MD5 calls explicitly as non-security uses and narrowly suppressing mandated SHA transforms
• release 0.6.4+gloss.3 as signed, self-contained arm64/x86_64 macOS runtimes with checksums, provenance, source artifacts, and attestations

Validation

• Ruff check and formatting passed
• 135 pytest tests passed locally
• release-tool tests, shell syntax, deterministic wheel/sdist, and archive checks passed
• rebuilt the real arm64 PyInstaller runtime (224,158,447 bytes; 1,326 files, 230 directories, 0 links)
• the extracted materialized bundle passed runtime identity, native dependency, layout-service, fake-executor, and production babeldoc forkserver startup/health/shutdown smoke checks
• GitHub Checks, Linux/macOS wheel smoke, CodeQL Advanced, and the CodeQL security gate all pass on the final SHA
• all CodeQL review threads are automatically resolved and there are no open alerts on the PR merge ref

Release note

The tag to publish after merge is v0.6.4-gloss.3. The manifest signing secret is required and the workflow fails closed when it is unavailable.