chore(release): enforce the generated source-policy boundary

[abrichr]

Summary

• Add the canonical generated public source policy and fail-closed guard.
• Scan the tracked repository tree and the actual wheel and source distribution in the artifact build.
• Enforce the same guard in semantic release and recovery publication paths.

Verification

• Ruff passed for the changed Python scripts.
• The complete Python test suite passed: 829 passed and 6 skipped.
• The wheel and source distribution built successfully.
• Existing release consistency and artifact checks passed.
• The generated source guard passed on the source tree and actual distributions.
• A missing policy failed closed with exit 2.
• A forbidden real_emr archive path was rejected.

No package was published.