chore(release): prepare sigma-rust 0.29.0

[a-shannon]

Summary

Follow-up release preparation after #916 for the sigma-rust 0.29.0 line.

• close the 19-package version and internal dependency graph for 0.29.0, including standalone package feature closure;
• keep the three non-registry workspace members out of crates.io publication while preserving the canonical Python release tag;
• add dedicated C REST callback coverage, Python tag/version and test gates, least-privilege Python release permissions, and Cargo audit coverage on pull requests;
• add a non-publishing Rust/WASM release preflight with a tracked npm lockfile, exact Node/npm/wasm-pack pins, verified wasm-pack binary digest, candidate package identity checks, and pack/publish dry-runs.

This is intentionally separate from #896, which is the later 0.30.0 candidate and includes protocol changes.

Validation

• cargo fmt --all -- --check
• cargo clippy --workspace --all-features --all-targets -- -D warnings
• workspace test build and cargo test --workspace: 882 passed, 0 failed
• host no-default and thumbv7m-none-eabi no-std builds
• cargo package --workspace: 19/19 archives assembled and verified
• registry-eligible workspace cargo publish --dry-run: passed; no upload performed
• C REST callback tests: 6 passed
• Python 0.29.0 wheel and sdist builds, version import, 11 unit tests, stubtest, mypy, and doctest: passed
• WASM Node/browser identities: ergo-lib-wasm-nodejs@0.29.0 and ergo-lib-wasm-browser@0.29.0; both npm pack --dry-run checks passed
• npm production dependency audit: 0 findings

The legacy WASM development-tool tree still reports 43 audit findings (19 high, 4 critical); all high/critical paths are dev-only and the generated packages have no dependencies. Modernizing that tooling is deliberately left to a separate change.

No release tag, crate, wheel, or npm package was published by this work.