chore(release): enforce the generated source-policy boundary

[abrichr]

Summary

• Add the canonical generated public source policy and fail-closed guard.
• Replace the copied crown-jewel path list with the canonical generated rules.
• Keep the separate MIT license and user-artifact checks.
• Scan the tracked repository tree and the actual wheel and source distribution in CI and release validation.

Verification

• Ruff passed for all scripts.
• The complete test suite passed: 89 passed.
• The wheel and source distribution built successfully.
• Existing license and release-artifact checks passed.
• The generated source guard passed on the source tree and actual distributions.
• A missing policy failed closed with exit 2.
• A forbidden real_emr archive path was rejected.

No package was published.