ci(release): reconcile platform manifest after publish

[abrichr]

What changed

• reconcile platform-manifest.json only after the exact launcher artifacts are published to PyPI
• retry briefly for PyPI propagation, then run strict live and offline manifest validation
• commit the exact published artifact URLs and SHA-256 digests back to main as OpenAdapt Bot
• include reconciliation in the release failure issue path
• update the release-manifest documentation and reconcile the current 1.8.0 drift

Why

Semantic Release must bump pyproject.toml before it can build and publish a new launcher. The manifest validator correctly refuses to name that version until immutable PyPI artifacts exist, so release 1.8.0 left main red with manifest 1.7.3. The durable fix is post-publish reconciliation, not weakening validation.

Verification

• actionlint .github/workflows/release-and-publish.yml
• python scripts/validate_platform_manifest.py (live PyPI/status sources)
• python scripts/validate_platform_manifest.py --offline
• python scripts/check_source_boundary.py
• python scripts/verify_release_lock.py
• ruff check openadapt/ scripts/ tests/
• ruff format --check openadapt/ scripts/ tests/
• pytest tests/ -q (43 passed, 6 skipped without optional sibling packages)
• python -m build
• python scripts/verify_release_artifacts.py

The live validator still reports status-page version skew as warnings (launcher 1.8.0 vs 1.7.3; Desktop 0.14.0 vs 0.13.0). Those warnings are preserved intentionally; PyPI remains authoritative for immutable component artifacts while the Web status document updates on its separate cadence.