feat: persist extended-stable closeout evidence

[kevinslin]

Summary

• add a closed extended-stable-closeout mode to the existing release-evidence workflow
• validate the exact public closeout, plugin publication, core publication, and full-validation runs before accepting evidence
• persist an immutable evidence record with exact-replay no-op behavior, partial-write recovery, and conflict rejection
• keep the default evidence workflow unchanged and grant no npm mutation authority

Companion source PR: openclaw/openclaw#100508

Validation

• node --test test/openclaw-extended-stable-closeout-evidence.test.mjs (14/14 passed)
• workflow YAML parse, Node syntax checks, and git diff --check passed
• isolated Verdaccio proof covered a new line, patch update, stale-selector rejection, repair, and unchanged latest

Scope

This repository only validates and stores authoritative closeout evidence. Publication and registry readback remain owned by the source-repository workflow.