Require installation evidence after publication

[konojunya]

Summary

• Run real audited provider import/render during native release builds, including non-publishing dry runs.
• Invoke the reviewed reusable native installation matrix after stable GitHub publication and the eight-cell Cargo matrix after registry upload.
• Add always-running completion gates that distinguish stable publication, release candidates, and no-upload verification, rejecting failed/cancelled/skipped/missing required results.
• Preserve immutable release assets and explicit all-channel activation; document failure notifications and verification-only recovery.

Validation

• 26 focused Node guard tests passed, including failure-state and workflow-mutation cases.
• Release trust validator passed with all eight reviewed jobs and exact permission/action boundaries.
• actionlint passed for all three workflows; whitespace checks passed.
• PR CI runs the full 19-cell published installation matrix. After merge, a native release dry run will validate the new prepublication import and completion path without publishing another version.