fix(ci): stabilize generated release PR checks

[f0rr0]

Summary

• Allow the release-intent guard to accept generated release PR merge commits on main while still rejecting manual version bumps.
• Treat the WASIX asset input fingerprint as a release-derived file so release-please version changes refresh it automatically.
• Set up Rust in the prepare-release-pr job because the sync delegates fingerprint calculation to xtask.

Validation

• .github/scripts/check-release-intent.sh release PR, main merge, and manual-branch rejection cases
• tools/release/sync_release_pr.py --check
• cargo run -p xtask -- assets verify-committed
• tools/release/release.py check
• bun tools/policy/assertions/assert-ci-workflows.mjs
• tools/policy/check-workflows.sh
• git diff --check