test(ci): bind release image to Python matrix

[brownjuly2003-code]

Summary

• bind the root release Dockerfile Python minor to the declared package classifiers
• require that release-image Python minor to be installed by at least one CI quality path
• prevent a Dependabot runtime jump such as closed PR chore(deps): bump python from 3.12-slim to 3.14-slim #65 from appearing compatible without matrix adoption

Evidence

• exact PR chore(deps): bump python from 3.12-slim to 3.14-slim #65 Dockerfile simulation: expected RED (Python 3.14 classifier missing)
• current main: tests/test_compatibility_matrix.py — 11 passed
• broader compatibility/docs/protection/release governance — 52 passed
• Ruff, Black, pre-commit, git diff --check, LF index — PASS
• Grok adversarial exact-diff review (local_grok_cli / grok-4.5) — SAFE

No production code, workflow, runtime image, dependency, paid LLM, or user HTML changes.