Consolidate release operator commands

[Augani]

Summary

• add one operator-facing scripts/dory-release.sh command with check, candidate, status, and publish actions
• share exact-main/version/build/release-absence preflight across candidate and public publication
• wait for the exact dispatched run; private candidates download into the ignored release-build area
• reduce the former publisher to a compatibility shim and document implementation boundaries
• add offline regression coverage and retain fail-closed physical qualification

Why draft

Dory 0.4.6 candidate run 33234413167 is currently bound to main SHA 5ef9f85. This PR must not merge until that release is completed or intentionally restaged, otherwise the exact-main release identity changes.

Verification

• bash -n scripts/dory-release.sh scripts/publish-release.sh
• shellcheck scripts/dory-release.sh scripts/publish-release.sh
• python3 .github/scripts/test-dory-release-command.py
• python3 .github/scripts/verify-release-workflow-contract.py
• python3 .github/scripts/test-release-candidate-workflow.py
• python3 .github/scripts/test-release-orchestrator.py
• live read-only scripts/dory-release.sh status 33234413167
• git diff --check