[DimitryZH]

Summary

Add pull request and main-push validation with separate installed-package regression and new-release eligibility checks.

Changes

• Pin read-only hosted Actions; test Python 3.11 and 3.13 with a clean installed wheel and external module/console/schema checks.
• Discover new release files from cumulative PR or exact push comparisons; enforce merged-manifest immutability and unique release IDs.
• Preserve registry CLI diagnostics and failure codes; report explicit success when no candidates change.
• Document check names, trust boundaries, and owner-managed required-check settings.

Validation

All 60 local automated tests and clean-wheel checks passed, including the expected 12 baseline legacy failures. Git diff whitespace checks passed. GitHub Actions run: Python 3.11 and 3.13 tests/package checks passed; Release check passed with explicit no_candidate_changes. Logs inspected.

Limitations

Required checks and review ownership need owner configuration. Historical baseline remains ineligible; Compose and deployment are outside scope.

Related to #9

[DimitryZH]

Reviewed candidate discovery, release immutability, validation orchestration, and workflow permissions. All three GitHub Actions checks passed for the reviewed commit. No blocking findings remain within the scope of #9.