release: add protected production artifact authority

[daniele21]

Outcome

Add the GRP-5 production-artifact automation consumed by the existing draft-release workflow, without introducing a second build owner or weakening Apple distribution requirements.

Change

• add manual read-only .github/workflows/production-release-artifact.yml, targeting the production-release environment;
• accept an exact vX.Y.Z tag/SHA in main history and fail closed on tag/version/source mismatches;
• keep run-scoped signing/notary authority ephemeral and delegate all build/sign/notarize/staple/Gatekeeper work to scripts/build_production_artifact.py;
• extend the canonical builder with an optional explicit notary keychain path;
• validate production manifest/evidence/DMG/checksums before uploading closedroom-production-release-<SHA> for GRP-4;
• register release_production_artifact and update durable release state;
• add workflow/tooling contract tests.

Axes

• PRODUCT: PRODUCT_NONE
• DELIVERY: INTEGRATION
• VALIDATION: FULL (release/build/CI identity)
• EXECUTION: REMOTE_AUTOMATED for integration gates; REAL_ENVIRONMENT/protected authority remains required for an actual Developer ID/notarized production success.

Remaining gap

This PR validates the automation contract. It does not prove that the production-release environment protections/secrets are configured, nor does it claim Apple distribution qualification. A successful real GRP-5 run remains blocked until that external authority is configured.