Replace release/container scaffolding and complete contractile probe migration

[hyperpolymath]

Why this is recorded

The central estate hygiene gate correctly found unresolved markers outside documentation. PR #162 introduces a narrow .cicd-hygiene-allow so literal detector/template data and already-numbered native gaps do not make unrelated delivery work impossible. The following items are real repository debt and must not disappear behind that allowance.

Release workflow

• replace the placeholder build job with the real, reproducible Gossamer release build
• upload the platform artifacts actually produced by the packaging recipes
• feed immutable artifact digests into the SLSA provenance generator
• attach those artifacts to the GitHub release
• pin the git-cliff download by version and digest rather than latest

Container delivery

• replace the generic Wolfi builder scaffold with the actual Zig 0.15.2 Gossamer build
• copy a real runnable Gossamer artefact into the runtime image
• give the entrypoint a real default command while preserving explicit command override
• pin base images by digest and verify the image with a positive runtime smoke test

Contractile migration

• migrate the remaining probe | String forms to base.probe_schema
• retain compatibility only if the contractile CLI demonstrably needs it
• add fixtures proving both valid structured probes and rejected malformed probes
• remove the contractile paths from .cicd-hygiene-allow once complete

Exit criteria

• no unnumbered placeholder/debt markers in release or container implementation
• release and container paths execute real builds and planted runtime controls
• contractile structured probes validate end-to-end
• corresponding .cicd-hygiene-allow entries removed