fix: make release gates deterministic

[tensornull]

What changed

• make latest-within-major OpenAI compatibility blocking on every PR/default-branch run
• accept and validate Release Please native dated changelog headings
• bind immutable release evidence across changelog, roadmap, releasing, artifacts, workflow run, commit, tag, and digests
• reject exact CometAPI patch identities in durable current-state documentation, including Markdown targets and common semantic variants
• pin the reviewed Node 24 PyPI publisher and harden first-attempt release/live/publication workflow semantics
• move README/examples/live smoke to the canonical gpt-5.6-sol model with bounded terminal validation

Local verification

• uv sync --locked
• Ruff check and format check
• Pyright strict
• full non-live pytest: 535 passed, 1 live deselected
• minimum OpenAI 2.45.0: 535 passed
• locked OpenAI 2.45.0: 535 passed
• latest-within-major OpenAI 2.51.0: 535 passed
• version/public-preview/releasable/secret/workflow semantic checks
• actionlint 1.7.12
• wheel/sdist build, twine check, artifact inspection
• independent wheel/sdist clean installs and all README examples
• copied standalone repository verification
• git diff --check

Scope

No runtime SDK source, project version, release manifest, lockfile, or CHANGELOG release entry is changed. Release Please must create the next patch release PR.