Wire the release transaction to real registries, Releases, and Issues

[ronimoe]

Context

release_txn.RegistrySim/IssueSim define the exactly-once contract. Wire real npm/cargo/PyPI/crates publish + gh release create + issue close, with a per-registry 'version already exists' => SUCCESS mapping.

Acceptance

Merging a release PR publishes once, tags once (nonce mutex), closes issues once; idempotent under retry/crash.

Seam

tools/conductor/release_txn.py.

[ronimoe]

Implemented in 967fe7f.

gh_ports.py provides the real side-effect ports the exactly-once run_release drives:

• GitHubIssuePort — close-if-open + comment-once (marker dedupe)
• GitHubReleasePort — create-if-absent
• RegistryPort + npm/cargo/pypi presets — publish-if-absent

All idempotent: already-published / already-closed / duplicate-comment map to exactly-once SUCCESS, so the nonce-tag-mutex winner can safely re-run after a crash. run_release gained an optional releases port that creates the GitHub Release exactly once, gated on winning the tag election (registry publish + issue close were already gated and journalled).

Unit-tested (test_gh_ports.py): each port idempotency + error-mapping with injected runners, and run_release creating the GitHub Release exactly once across two concurrent releasers + a recovery re-run. Remaining for full close: the per-registry publish auth/CLI wiring and live validation (publish/release/issue commands shell out).