Release finalizer v3: verify and publish Mneme 3.6.0

[OnourImpram]

This is the definitive, clean main based Mneme 3.6.0 finalizer.

It is idempotent. When 3.6.0 is already completely public, it records the evidence and closes without a repository change.

Otherwise it restores the ten-loop source from GitHub pull request 30 only when the engineering report is absent, removes every one-time transfer and release automation artifact, locks all version sources to 3.6.0, updates release notes, runs the complete test, lint, type, integrity, plugin-validator, build, package, and seeded benchmark surface, merges only the verified net diff, creates or validates an immutable annotated tag, reuses, repairs, or dispatches trusted publishing, and confirms the GitHub Release, four PyPI distributions, and npm package through public endpoints.

It never force pushes, moves an existing tag, rewrites history, deletes a release, weakens a gate, or mutates user vault data.

[OnourImpram]

Superseded by #36.

Unique diff inventory against #36 finalization head:

• The temporary finalize-and-publish workflow and its ready marker are intentionally removed.
• The maintained release.yml provides the verified artifact and tag-push-only publication contract and passed the exact-head 3.6.0 dry run.

No unique validated product diff remains. Closing as superseded without merge or publish.