fix: preserve selected release execution

[tensornull]

Summary

• force every job after the mutually exclusive release selector to evaluate skipped ancestry
• reject cancellation, reruns, and any direct dependency whose result is not success
• pin the conditions in the semantic checker, add mutation coverage, and record the failed recovery evidence in durable documentation

Root cause

Recovery run 30357111315 verified the immutable release and passed select-release, but GitHub propagated the intentionally skipped Release Please ancestry into jobs with plain conditions. Build, live smoke, publication, and registry verification all skipped while the workflow reported success.

Impact

A successful verified selector now reaches build on the first attempt. Cancellation, reruns, failures, skipped direct dependencies, and missing dependency results remain fail-closed.

Verification

• uv lock --check
• Ruff check and format check
• Pyright
• 253 non-live tests
• version, public-doc, secret, workflow-semantic, and offline actionlint checks
• clean wheel and source build, metadata/artifact checks, and independent clean installs
• copied standalone-repository verification
• independent adversarial workflow review