refactor(release)!: simplify releases and make contrib runtime-owned

[f0rr0]

Summary

• Remove repository-shape policy tests, synthetic release state, semantic fingerprints, local-registry machinery, and completed recovery code.
• Retire contrib as an independently versioned release product; native owns its 12 native/npm/Maven carriers and WASIX owns its 5 portable/AOT carriers.
• Keep native and WASIX independently releasable while shared contrib and PostgreSQL inputs explicitly select both runtime owners.
• Shrink the graph/query/plan layer from 2,885 to 1,845 lines by deleting dead query commands and unused workflow outputs.
• Keep Moon as the single relationship authority for project ownership, dependency closure, and product ordering; publication locks still order actual carrier dependencies.
• Harden shared-contrib Release Please handling, exact reruns, and WASIX evidence reuse.
• Restore a real external Rust consumer built from the packed crate and run against the same-run Linux runtime.

Breaking change

The public contrib Cargo facade is native-only. Runtime-owned contrib carriers now take the version and release identity of their native or WASIX owner. Historical 0.1.0 and 0.1.1 packages and tags remain immutable; the first migrated native runtime release should use 0.2.0.

Correctness and robustness

• Mixed shared-contrib changes promote an insufficient existing runtime candidate instead of blocking Release Please.
• Shared-contrib reasons merge into existing runtime changelogs and remain idempotent.
• Released-main and first-release reruns do not seed another shared-contrib bootstrap PR.
• A rerun accepts earlier-attempt WASIX evidence only when repository, workflow, run ID, source SHA, tree, and job still match; future-attempt evidence is rejected.
• The Rust release consumer compiles outside the workspace from the extracted published crate and executes a query through the packaged runtime.

Impact

• Native-only releases do not publish WASIX contrib carriers.
• WASIX-only releases do not publish native, npm, or Maven contrib carriers.
• Shared contrib inputs fan out explicitly to both owners without introducing a second dependency graph.
• This PR removes 86,506 net lines across 486 files.
• The release workflow shrinks from 3,591 to 1,980 lines.

Validation

• Full release check: 1,022 passed, 2 platform skips, 0 failed.
• Latest shared-contrib/rerun focused checks: 48 passed, 0 failed.
• Release metadata: 17 products, 186 stable carriers, 346 artifact targets.
• Packed Rust consumer build passed locally; its Linux execution is wired into PR CI.
• Actionlint, zizmor, workflow security, extension-model validation, formatting hooks, and git diff checks pass.