release: add a non-publishing rehearsal path

[pengfei-threemoonslab]

Problem

The release workflow can only be exercised by pushing a v* tag, so its verification and failure paths are effectively first-run at the same moment publication becomes possible. The broader release review was tracked in #345; this issue owns the rehearsal path only.

A rehearsal must exercise the candidate build and verification path while being structurally incapable of publishing, tagging, or creating/finalizing a GitHub Release.

Acceptance criteria

• A manual or reusable dry-run entry point exercises the same build, qualification validation, tests, dependency audit, SBOM generation, and artifact handoff used by release.
• Dry-run mode never instantiates the publication job and has no contents: write or PyPI publishing authority.
• The dry run cannot create a tag, upload to PyPI, or create/finalize a GitHub Release, even if a step is misconfigured.
• At least one deliberate mismatch/failure path is rehearsed and shown to fail closed before publication.
• The run produces inspectable candidate artifacts and a concise readiness summary.
• The release runbook makes rehearsal mandatory for a candidate tag.

Related

• release policy: decide the approved evidence bar for pre-1.0 tags #341 — approved qualification policy
• release security: bind the qualified wheel to the tagged source tree #342 — source-to-wheel provenance
• release: separate verification from publication and make partial publish recoverable #343 — publication transaction and recovery
• release: align test selection with CI and set a measured timeout #344 — deterministic test workload and measured budget
• release cleanup: use CHANGELOG notes and lock release dependencies #345 — remaining lower-priority release cleanup
• PR Add manual release dispatch workflow #77 is historical context, not the implementation baseline; its May-era publish-capable workflow must not be revived as a “dry run.”