Harden gd-redis test and release gates

[nicodes]

A10 L0 — truthful test and release gate

Tracks the gate layer of https://github.com/aviorstudio/fieldsofrevik/issues/150. This PR does not implement the RESP/deadline behavior layer and does not auto-close the cross-repository issue.

Self-verification evidence (Team No Review)

• Source: aviorstudio/gd-redis, issue-150-studio-engineering, exact head f4216b53d719bb318360afcff54f8beab30a3f18; baseline dea4b076055080faac2aa90aa4bd252c4e70b754.
• Scope: mandatory Godot runner; checksummed Godot 4.7.2; closed-manifest package; installed ZIP editor lifecycle; least-privilege release jobs; immutable action pins; same tested bytes handed to release/GDAM. No Redis behavior/API or game changes.
• Versions: Godot 4.7.2.stable.official.ed1daf0bf; GNU timeout 9.9 (TERM, --kill-after=5); Docker 29.1.3; pinned Redis 7-alpine digest ff02b58...28eadf.
• Gate controls: runtime-error/zero-exit, overwritten assertion exit, unreachable sentinel, parse failure, 1-second stall, and absent suite were each rejected. Restored fixture passed with Godot assertions reached: 1/1; real suite passed 2/2.
• Package controls: missing, unexpected-development-file, traversal, and symlink archives were each rejected; restored closed manifest passed (7 files).
• Artifact identity: post-commit local ZIP SHA-256 1a8cc1410e355c5703ca4855b08109b081971df6cd03d15d09245d1a8e7b5afc; installed-tree SHA-256 fc1288a93a39c9f85a60f6a5dec4a5d6272beafc4b62fc0aca459fd1b238db08. CI/release will publish their generated exact-byte identity.
• Packaged lifecycle: clean fixture installed ZIP; editor/plugin add/remove path exercised; consumer-owned autoload survived; editor restarted after disable; PASS. Narrow allowlist covers reproduced Godot 4.7.2 editor-shutdown resource/RID messages only.
• Commands: ./scripts/install-godot.sh /tmp/opencode/gd-redis-godot; GODOT_BIN=... ./tests/test_runner_controls.sh; GODOT_BIN=... ./tests/test.sh; ./scripts/build-addon-package.sh; ./scripts/test-package-controls.sh; GODOT_BIN=... ./scripts/verify-editor-lifecycle.sh; git diff --check.
• Safety: integration uses unique 30-second TTL keys; FLUSHDB remains disabled by default and unused. Fixture binds random loopback port and is removed on exit.
• Browser evidence: N/A for this native/server addon gate; no browser surface changed.
• Exact-head CI: PASS — https://github.com/aviorstudio/gd-redis/actions/runs/34743088161 at the exact SHA above.
• Untested/residual: behavior-layer parser bounds/deadlines, fragmentation, binary/malformed RESP, stalls/disconnect/cancel, and release/registry production checks remain outside this gate PR.