Harden release packaging input boundaries and correct flavor documentation

[den-sq]

Context

The Ouroboros 1.5.2 all-flavor build exposed an input/output overlap: generated release artifacts under the checkout could become inputs to later Electron Builder package operations. The immediate directory exclusions are being handled separately as a narrow fix.

This issue tracks the broader hardening work without expanding pull-request CI into full native release builds.

Scope

• Treat the checkout as read-only package input.
• Put staging and final outputs under RUNNER_TEMP, outside GITHUB_WORKSPACE. GitHub provides RUNNER_TEMP for temporary job files: https://docs.github.com/en/actions/reference/workflows-and-actions/variables
• Replace the broad Electron Builder input set with an explicit allowlist.
• Correct documentation/docs/development/production-package-flavors.md from line 20 onward:
  • remove obsolete manual workflow inputs;
  • remove hard-coded stale plugin pins;
  • point mutable release identities to the authoritative release/release-lock.json.

Acceptance criteria

• Packaging inputs cannot contain generated staging or final release outputs.
• Each flavor starts from the same clean application input basis.
• Electron Builder receives only the declared application files and resources.
• Release documentation has one authoritative source for mutable pins.
• Fast release preflight checks cover the input/output boundary.

Non-goals

• Do not run full macOS, Windows, and Linux installer builds on pull requests.
• Full native release builds remain a main-only operation.
• Do not redesign the release or publication lifecycle as part of this issue.