Prepare and validate release branches before publication

[samuel-williams-shopify]

Release branches need to contain the version bump and every generated release change before review. The existing branch task treats the version task's result hash as a filename, creates the branch after generation, and stages only the version file.

This fixes gem:release:branch:patch/minor/major to require a clean branch checkout, create releases/vVERSION before generation, run the existing hooks, and commit all resulting changes. Generated private keys and package output are rejected before staging; failed hook output remains available for inspection.

gem:release:validate base=... candidate=... independently regenerates a release from the base and proposed version, then compares the complete source tree. Rebases pass when the generated content still matches; stale notes and unexpected additions or deletions fail with a diff. After merge, callers use the merged commit's first parent as the base. Validation supports stable patch/minor/major versions and requires repeatable hooks.

Worktree operations run ordinary Bake tasks in fresh Ruby processes, avoiding cached version constants and building from committed source. gem:build accepts a signing key path or true/false, and local publication pushes only the intended release tag. The helper requires the caller to run from the gem's root directory and never changes the process's working directory.

Tests use Sus 0.38's TemporaryDirectoryContext and IsolatedRubyContext, with explicit chdir: root. The guide, generated agent context, and Unreleased notes document the behavior. This provides the provider-independent foundation for the separate bake-gem-github integration.

Validation:

• 40 tests / 88 assertions pass, including parallel execution and a fresh coverage run on Ruby 4.0.6.
• All 111 added or changed executable lines relative to origin/main are covered. Overall line coverage is 90.65% (320/353); remaining gaps are in unchanged code. The existing global 100% CI coverage gate remains unchanged.
• Tests cover task entry points, complete hook output, stale content after rebase, merged-commit validation, package contents, certificate signature verification, signing options, rejection cases, and worktree cleanup. Local publication uses a temporary bare Git remote with RubyGems upload stubbed, verifying that unrelated tags are not pushed.
• RuboCop passes for the updated tests. The previous revision's runtime matrix, including JRuby and TruffleRuby, lint, and documentation checks passed; CI will rerun for this update.