ci(release): accept generated release metadata

[tulayha]

Summary

• accept trusted-publishing .publish.attestation sidecars while still rejecting unknown or changed distribution files
• make release-contract tests follow the synchronized repository version, including Release Please numbered betas such as 0.4.0-b.1
• prevent Dependabot from treating the Rust toolchain ref as an action release and from needlessly pinning the tracked CodeQL v4 major ref

Failures addressed

• nightly 0.4.0.dev19 uploaded successfully, then failed exact-artifact verification on registry-generated attestation sidecars
• release candidate validation failed on Python 3.11–3.14 because a test hardcoded v0.4.0-b after Release Please correctly generated v0.4.0-b.1
• Dependabot PR build(deps): bump the github-actions group across 1 directory with 2 updates #59 selected nonexistent Rust 1.100.0, causing all three desktop jobs to fail before building

Validation

• 7 focused release/verifier tests pass
• exact artifacts from failed nightly run 30810984579 compare as identical against live TestPyPI
• Dependabot YAML parses successfully
• Ruff and whitespace checks pass
• the original release candidate independently passed containers, macOS/Linux desktop, and provider jobs; only the shared hardcoded assertion failed across the Python matrix

The ci commit type intentionally keeps this operational correction out of the generated product changelog and does not request a version bump.