fix(ci): persist release evidence run attempts

[vincentkoc]

Summary

• require full_validation_run_attempt on repository-dispatched evidence ingestion
• read the exact parent workflow attempt and attempt-qualified jobs
• persist runAttempt in schema-v2 run records while retaining schema-v1 readability
• make exact duplicate attempts no-ops and reject stale attempt rollback
• bind the parent record to its exact manifest artifact, SHA, and completion timestamp

Why

This is the downstream receiver contract for:

• improve(release): bind Gateway-node compatibility evidence openclaw#120032

The OpenClaw publisher confirms durable release evidence by exact Full Release
Validation run ID and attempt. The releases ledger previously discarded the
attempt and could resolve mutable current-attempt state instead.

Dependency

Stacked on:

• fix(ci): harden release evidence publication #14

That PR owns the hardened manifest-based release-evidence receiver. This PR is
only the exact-attempt persistence and idempotency delta.

Rollout

1. Merge fix(ci): harden release evidence publication #14.
2. Merge improve(release): bind Gateway-node compatibility evidence openclaw#120032. Its added payload
   field is ignored safely by the receiver from step 1.
3. Merge this PR, which then requires and persists the field.
4. Prove one exact cross-repository dispatch before closing release validation.

Validation

• node --test scripts/openclaw-release-evidence-contract.test.mjs (8 passed)
• node --check on all three evidence scripts
• actionlint -shellcheck= -pyflakes= on the receiver workflow
• yamllint with the repository's existing workflow style allowances
• git diff --check
• read-only live ingest of Full Release Validation run 30714067986, attempt 1
  • schema v2 persisted runAttempt: 1
  • parent stored exactly one full-release-validation-30714067986-1 artifact
  • repeated ingest was byte-identical and produced no update
• local autoreview through P2: clean
• local ClawSweeper at 64afaa739e0b41097de700ac24717bafb8a868a6
  • high-confidence keep_open
  • no code or security findings

Compatibility

• manual workflow dispatch keeps the attempt input optional and resolves the
  current attempt when omitted
• repository dispatch requires the exact attempt supplied by the current sender
• schema-v1 evidence remains verifiable; an exact retry upgrades it to schema v2
• child workflow attempts remain outside this delta because the upstream v3
  manifest currently supplies child run IDs only

Punchcard

Commit trailer: Punchcard-Session: coral-meadow-meadow-8y

Attestation could not be recorded because that active session is registered to
openclaw/openclaw; Punchcard returned INVALID_INPUT for this
openclaw/releases commit.