Publish installable authoritative Python agent releases

[AntoineToussaint]

Problem

CLI production pinning of Python v0.0.26 failed on a clean GitHub runner: Core tried Nix, OCI, and GitHub, then received a 404 because v0.0.26 is only a source tag. This repository has no tag release workflow; downloadable releases stopped at v0.0.24. Local dogfood passed only because v0.0.26 had been built into the operator cache.

Required owner fix

• add the Core-compatible service-python_<version>_<os>_<arch>.tar.gz GoReleaser contract;
• publish real CGO/tree-sitter binaries for darwin/amd64, darwin/arm64, and linux/amd64;
• add the repository-owned tag workflow;
• publish a new immutable installable version carrying v0.0.26 authoritative project inspection;
• prove a clean CLI Gateway downloads and runs it.

No CLI fallback, test skip, or reversion to the older non-authoritative agent.

[AntoineToussaint]

v0.0.27 correctly failed before packaging: the new tag workflow ran the real runtime suite without installing required uv, so TestRuntimeHonorsTypedSelectionWithDefaultRunner and TestRuntimeDefaultRunnerMaterializesDeclaredRequirements failed. No test was skipped or weakened.

The immutable v0.0.27 tag remains failed. The release contract now also requires provisioning uv in the tag test job and publishing a fresh v0.0.28 after that workflow fix is merged.