Harden and exercise the container release contract

[Chris0Jeky]

Purpose

Resolve the three release-container residuals in #1854:

1. execute container version derivation against stable, build-metadata, prerelease and rehearsal refs in the required release contract lane;
2. reject v* tags that are not valid release semver before docker/metadata-action processes them;
3. run the tag smoke container under fail-fast shell semantics with guaranteed cleanup.

Red → green evidence

RED — exact contract-only head. Commit e36dc0cb6888c66ae4eff9b7ea895b497fcf59a7 added the executable contract and required-lane wiring before release implementation changed. Main CI run 34921632532, Release Workflow Contract job 104230817506, first passed all 87/87 existing desktop release checks, then failed 7/7 new container checks for exactly the intended boundaries:

• the resolver did not exist for stable, build-metadata, prerelease, rehearsal, or invalid-tag cases;
• release-container.yml still derived the version inline rather than calling a tested authority before metadata generation;
• the tag smoke step lacked set -euo pipefail and an EXIT cleanup trap.

GREEN candidate. Exact head c8118b537f45b1214da33da731ef5550750912d7 adds the resolver and consumes it from the workflow, then hardens the smoke step. Smart CI, Extended CI, and main CI are running; this PR remains draft until the complete exact-head matrix settles.

Design

• scripts/ci/resolve-container-version.sh receives the real Git ref. Tag refs must clear the shared validate-release-tag.sh grammar, then lose only build metadata; non-tag manual rehearsals retain 0.0.0-dev.
• The resolver keeps a second plain-token guard because its output reaches MSBuild and Docker metadata.
• Product-version resolution still precedes docker/metadata-action, so malformed v* refs fail before image tags or publishing are computed.
• The tag smoke step uses fail-fast shell semantics, while an EXIT trap removes taskdeck-smoke on startup, health, extraction, assertion, or explicit-exit failures.

Scope

• Four files: container release workflow, tested resolver, executable contract, and required-lane wiring.
• No image contents, GHCR permissions, stable/prerelease floating-tag policy, desktop release, application runtime, or production deployment behavior changes.

Closes #1854