APP-96: Enforce complete Truffile release packages

[temp-deepshard]

Why

A clean Truffile wheel can omit truffile.app_runtime and generated truffle protos. Generated apps then fail on their first import, while dirty local checkouts hide the problem.

Changes

• stages the ignored runtime and generated protos from the private pyfw source of truth
• fails the build independently when either required package is missing
• pins the protobuf compiler/runtime pair used for release builds
• raises the packaged protobuf, gRPC, and reflection requirements to match generated code
• verifies wheel contents and imports in a fresh Python 3.12 environment
• runs the missing-package contract in PR CI

Validation

• exact pushed commit 2e8a0875e81145d52bbafb55ea3a027d1a2bf1c3: 163 passed, 3 subtests passed
• final combined suite: 216 passed, 9 subtests passed
• Packaging contract CI: passed
• real private-source proof: truffle-apps run 29476643574
• pyfw source: 14ae88a4a2f8b08b11db22dec533de22fbac8517
• the first real-source run caught protobuf 7.35 gencode being installed with a 6.33 runtime; the pinned toolchain fix was then rerun successfully
• the successful run regenerated protos, built the sdist and wheel, installed the wheel into a fresh Python 3.12 environment, imported runtime/client/SDK and both generated scaffold entrypoints, and verified the wheel
• verified wheel SHA-256: b8ba38207584e0b19845589aae48244506700de92f1e85dfa9024de54895f6f2
• no artifact was uploaded or published, no deployment step existed, and no generated runtime, proto, wheel, or build artifacts are committed

Linear: APP-96