Render immutable release identifiers

[kebanks2]

Summary

• Add deployment manifest rendering that records immutable release identity annotations for commit SHA, package version, image digest, and release id.
• Keep mutable branch/tag refs as secondary source metadata instead of the primary release identity.
• Add release-history storage that can be queried by immutable release id.
• Include regression coverage for annotation rendering, release lookup, and input manifest isolation.

Validation

• python3 -c "import sys; sys.path.insert(0, '/tmp/ao-pytest'); import pytest; raise SystemExit(pytest.main(['tests', '-q']))" -> 25 passed
• touched-file flake8 passed for deployment, package exports, metrics, and deployment tests
• python3 -m compileall -q src tests
• git diff --check
• star gate verified: viewerHasStarred=true

/claim #1863

Payout details can be provided privately on acceptance.