fix: validate GDAM publish inputs for v0.0.4

[nicodes]

Summary

• Remove unsupported publish.version while preserving valid install.version: v0.0.8.
• Check GDAM action inputs structurally against immutable upstream contract snapshots in the shared CI/release test action; provision hash-pinned PyYAML explicitly.
• Add old-input rejected → fixed pass → reinjected rejected → restored pass controls, valid install input coverage, unknown/missing-input and revision controls.
• Prepare approved next patch v0.0.4 without modifying Redis client/transport behavior.

Tracking: aviorstudio/fieldsofrevik#169 (close only after release and registry verification).

Verification

• 6 workflow contract tests passed, including actual baseline release workflow rejection.
• Package manifest: missing/unexpected/traversal/symlink negative controls and restored package passed.
• Shell syntax and git diff --check passed.
• Full Godot/owned loopback Redis/editor checks pending scheduled local exclusive lease; same checks run in CI.
• No production Redis access, no FLUSHDB, no consumer changes.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}