Harden telemetry test and release gates

[nicodes]

Team No Review self-verification evidence

Tracks aviorstudio/fieldsofrevik#156 (gate layer 1/2; does not auto-close the cross-repository issue).

• Source: aviorstudio/gd-telemetry head 87a0d17978a0528e094586c6a386d504c2b2de05; known-good baseline 655ee35c4ef8c56edf6a7959a1dd302ce271d77e established the existing suite behavior.
• Scope: truthful Godot runner, Godot 4.7.2 checksum pin, full-SHA actions, least-privilege two-job release, deterministic closed-manifest ZIP, installed-package editor lifecycle, and labelled README correction.
• Gate controls: runtime push_error with zero exit, overwritten failure exit, parse/unreachable assertion, 1s hang timeout, missing suite, traversal, symlink, and undeclared archive member all failed as required. Restored fixture passed with TEST_REACHED; real suite reported TEST_ASSERTIONS_REACHED=1/1.
• Local commands: GODOT_BIN=/tmp/opencode/godot-4.7.2/Godot_v4.7.2-stable_linux.x86_64 ./tests/gate_controls.sh; ... ./tests/test.sh; python3 scripts/package_addon.py build dist/@aviorstudio_gd-telemetry.zip; ... ./tests/package_controls.sh dist/@aviorstudio_gd-telemetry.zip; SHA check from dist/.
• Versions: Godot 4.7.2.stable.official.ed1daf0bf; Linux x86_64; source ZIP expected SHA-256 cadd3204e728a35d3f13adb7fd0d7902636b79f6b95c40c265eb73b6c35329e4; gdam-actions v0.0.2 commit d735444eb470194585def44521d5d91df2260e63.
• Local artifact: ZIP SHA-256 4d85038382c6d8cb6010c10bac405917f2bbd93db9859f1eb2e121c54432e352; installed-tree SHA-256 842677d92a899187db02aaac06cf38799807e9e17aff3c2bb89efdf4c9efa5d8.
• Package lifecycle: clean fixture enable/editor start/restart, installed smoke (PACKAGE_SMOKE_REACHED), disable/editor start/restart, consumer marker preservation: PASS.
• Browser evidence: N/A; this addon has no browser UI or web-specific code path. No screenshot can evidence the native/editor contract; browser verification is therefore not applicable.
• Exact-head CI: pending for this SHA; merge remains blocked until green.
• Untested/residual: release publication and GDAM install are post-merge gates; no macOS/Windows/mobile commitment; no heavy benchmark.

[nicodes]

Exact-head CI update: PASS for 87a0d17978a0528e094586c6a386d504c2b2de05 at https://github.com/aviorstudio/gd-telemetry/actions/runs/34717165230 (successful rerun, job 103616654277). All criterion evidence in the PR body remains current. Merge is blocked only by the required board transition/readback while shared GraphQL quota is exhausted.