0.7: Publish verified Python/npm clients with fresh-install acceptance #309

Parent: #289. Inspect source: #291.

Work boundary 11/13 from the approved 0.7 → clients → Inspect sequence.

Dependencies: #303, #304.

Retain capsem, @capsem/sdk and @capsem/mcp identities. Use verified release workflows and publish only proven package artifacts.

Acceptance criteria:

• Package artifacts install cleanly without workspace dependencies.
• Installed clients operate against the qualified runtime.
• Publication uses repository-authoritative workflows with exact artifact evidence.

Planned PR boundaries: Release workflow gaps separate from proven package publication.

Implementation progress and evidence: Sprinty in the isolated integration/0.7-clients-inspect worktree. Focused tests during development; fast checks/Citadel per PR; relevant black-box proof for runtime, credential or image boundaries. Respect the active release and machine locks.