security: harden release provenance validation

[codeforester]

Summary

Follow up on the post-merge correctness and coverage review of #375.

• Treat missing event payloads and all Git inspection failures as explicit validation errors.
• Fail closed when shallow-repository state cannot be determined.
• Exercise the production validator entrypoint, event payload parsing, deleted-tag handling, and shallow-query failure paths.
• Assert provenance dependencies independently for publication, attestation, and GitHub Release jobs.
• Centralize v-prefixed tag validation for both release validators.
• Simplify the PyPI dispatch condition.

Validation

• Full test suite: 401 passed
• Targeted provenance/workflow tests: 20 passed
• Ruff check and format check pass
• Strict mypy pass for the package and typed consumer
• git diff --check pass

Review follow-up

This addresses the actionable comments posted after #375 merged, including the missing-event Path('.') guard, fail-open shallow-state query, deleted-tag coverage, production-entrypoint coverage, per-job workflow assertions, duplicate tag-prefix logic, and the redundant production-release expression.

Fixes #376