fix: isolate release PR transport retries

[tensornull]

Summary

• split Release Please into a non-retryable release-only invocation and PR-only maintenance
• permit exactly one conditional retry for mutable PR branch maintenance
• enforce the boundary with parsed workflow checks, mutation tests, and durable release documentation

Root cause

Release Please run 30509764960 failed with other side closed after candidate generation and before any remote write. The pinned v5 action uses Node global fetch through Octokit; an isolated Undici closed-connection race can fail the Git commit read used by PR maintenance, and that path has no transport retry.

Retrying the former combined action was unsafe because the same invocation could also create an immutable tag and GitHub Release. The workflow now runs release creation separately with skip-github-pull-request: true and never retries it. Only the idempotent PR path uses skip-github-release: true, with one retry gated on the first step's failure outcome.

Validation

• Ruff check and format check
• Pyright strict: 0 errors
• 332 non-live tests
• version, public-document, secret, and workflow semantic checks
• actionlint 1.7.12
• wheel and sdist build, Twine, artifact inspection, clean installs, mocked calls, and README examples
• standalone copied-repository verification
• OpenAI 2.45.0 locked/minimum and 2.50.0 latest-within-major compatibility
• independent adversarial review: no findings

RELEASE_PLEASE_ENABLED and LIVE_SMOKE_ENABLED remain disabled. This PR creates no tag, GitHub Release, live request, or registry state.