fix(release): prepare Capture 1.3.0 for Production qualification

[abrichr]

What changed

• Keeps Capture responsible for raw native observation and local persistence. The consumer now owns authoring and remote-payload policy.
• Reconciles every current 1.3.0 feature into one release entry. The README no longer tells users of the 1.2.2 wheel to install main for commands that aren't published yet.
• Starts missing exact-commit test, hosted qualification, and live Linux runs from the release workflow. The gate requires package-contract plus three live trials on a qualified Linux desktop. It rechecks protected main immediately before it creates the tag.
• Installs the candidate wheel on Linux, macOS, and Windows. Each lane downloads and probes Capture's pinned FFmpeg runtime, then removes both the runtime and the package. Linux also installs the exact wheel with [linux] and imports AT-SPI.
• Exercises the API used by Flow 1.34.0 and Desktop 0.16.0 from the built wheel. This includes the Recorder constructor and state, CaptureSession loading and action access, and demonstrated shortcut conversion.
• Applies the canonical source policy's archive content patterns to the complete payload of every bounded wheel and sdist member. The scanner verifies the policy digest and rejects path aliases, case-fold collisions, encryption, links, special files, and excessive expansion.

Verification

• 43 passed in the release, repository, archive, lifecycle, and consumer-contract tests.
• Ruff passed on every changed Python file.
• Actionlint passed on all changed workflows.
• The 1.3.0 wheel and sdist built and passed both archive validators.
• The built macOS wheel installed in an isolated environment. Its pinned FFmpeg runtime downloaded, encoded and decoded H.264 into MP4, resolved from the Capture install, and uninstalled cleanly.

Required release operations

Do not publish from this pull request. GitHub App ID 4730708 still returns 404 for the Capture repository installation. Install that App on OpenAdaptAI/openadapt-capture first.

The final release SHA also needs the interactive Linux qualification. Register a Linux X64 desktop runner with the openadapt-capture-qualified label and set CAPTURE_SELF_HOSTED_QUALIFIED_LINUX_RUNNERS=1. The release workflow now dispatches and requires live-qualification.yml for that exact SHA.