[codex] Add package content equivalence release gate

[iiwish]

Summary

• Add repo-only npm package content equivalence verifier with schema agent-cli-runtime.packageContentEquivalence.v1.
• Add P8-8 evidence comparing P8-7 releaseTargetSha against current origin/main without claiming fresh main release-candidate evidence.
• Keep .release-evidence/ and the new verifier script outside npm package contents, with contract coverage and docs sync.

Evidence / Decision

• P8-7 target ff553b27f0765b4e2b67c60a05d28d4449423207 vs origin/main e1c493b99d54dc85eeef3e2c92a72bafe7f71e03 is package-content drift.
• P8-8 evidence records packageContentEqual: false, evidenceOnlyDrift: false, and freshReleaseCandidateRequired: true.
• No npm publish, GitHub Release mutation, npm token/trusted publishing setup, or authenticated real agent run is performed.

Validation

• git diff --check
• npm run release:package-content:verify -- --self-test
• npm run release:package-content:verify -- --base-ref ff553b27f0765b4e2b67c60a05d28d4449423207 --head-ref origin/main
• npx vitest run tests/contract.test.ts --reporter=verbose --testNamePattern "package content equivalence|P8-8" --testTimeout 30000
• npm run package:check
• npm run prepublish:check