[codex] Require store bridge dry-run evidence

[Atomics-hub]

What changed

• Added Slack, GitHub, email, and Postgres dry-run bridge reports to the release-candidate smoke artifact inventory.
• Made the release-ticket store/notification handoff require those artifacts before passing.
• Validated that delivery dry-runs prove local configuration placeholders, zero live deliveries, empty attempts, and no obvious live credential or database URL exposure.

Why

The store notification handoff previously proved redacted payloads and docs, but did not require actual local bridge dry-run reports in the release ticket. This makes the safe-agent/store-notification claim artifact-backed.

Validation

• cargo fmt --check
• cargo test --locked release_ticket_smoke_inventory_lifts_named_artifacts
• cargo run --locked -- release-ticket --out dist/release-ticket-store-dry-run-proof --force --json | jq '{ready, store: (.checks[] | select(.name=="store/notification handoff"))}'
• inspected generated Slack/GitHub/email/Postgres dry-run JSON reports
• cargo clippy --all-targets --all-features -- -D warnings
• cargo run --locked -- release-audit