release: 2.5.0 - Release Protocol V3 publisher (external manifest, anchored chain)

[Rwanbt]

Closes #180 (upon merge). Converts the official publisher to Release Protocol V3 and prepares the first V3 release, 2.5.0.

• Builder: scripts/build_lifecycle_bundle.py builds protocol 3 by default — ainative-lifecycle-v3-2.5.0.zip plus the external ainative-release-v3.json manifest (schema, protocol, version, channel, compatibility.runtime_version, artifact name/version/SHA-256/size, provenance). --protocol 2 remains for reproducing a bridge. release_v3.MANIFEST_ASSET_NAME is now the single owner of the manifest filename.
• Version gate: check_release_versions.py detects the protocol from the built artifacts (a V2/V3 mix fails) and validates the V3 chain — manifest version, runtime compatibility, artifact version, artifact filename, the anchored bytes (SHA-256 + size), and the bundle's own lifecycle-protocol.json (protocol 3, release version, payload VERSION). --protocol can force the expectation.
• Workflow: SHA256SUMS and the release upload now include *.json (the manifest is a real release asset; GitHub's asset metadata is the anchor the runtime reads). The protocol-aware bridge gate sits after the dist verification step.
• Upgrade E2E: the probe builder asks for --protocol 2 explicitly (it exercises the V2 transport path on purpose).
• Version: 2.5.0 across the labels, README/README.fr/UPDATING/RELEASING/operator-guide/pilot pins, and a CHANGELOG section.

Local proof: builder + wheel + sdist validated by check_release_versions.py --tag v2.5.0 --dist (4 artifacts, full chain); the gate ALLOWs against the real published bridge 2.4.4 and BLOCKs when V3_BRIDGE_RELEASE is unset (mutation); 315 lifecycle tests + 144 release/purity/gate suites green; conventions/scope/complexity/LOC green.

After merge: tag v2.5.0 on the exact merge SHA (CI must be green on it first), watch Release assets, verify the published V3 chain live from GitHub, run the smoke tests and refresh the qualification report.