Establish wheel-first release gates

[codeforester]

Summary

• add an explicit MANIFEST allowlist and archive validator that rejects stale or unexpected sdist/wheel members
• build from a cleaned artifact destination and exercise the reviewed wheel from an isolated installed-package smoke test
• expand source validation across Python 3.10–3.14 on Linux, macOS, and Windows while retaining Debian, Fedora, and WSL checks
• add Ruff, strict typing, coverage, documentation/example, Bandit, and pip-audit quality gates

Closes #67

Verification

• bash tests/validate.sh
• .venv/bin/python scripts/validate_docs.py
• .venv/bin/python -m mypy --strict examples/typed_consumer.py
• .venv/bin/python -m pytest -q
• clean sdist/wheel build plus scripts/validate_package_artifact.py
• Ruff lint and scoped formatting
• Bandit high-severity scan