fix(ci): enforce Actions artifact retention

[hechuan9]

Summary

• Standard Actions upload-artifact handoffs now declare policy-bound 3/7-day retention; the Pages deployment artifact retains its independent 1-day policy.
• The architecture guard recognizes inline and future action versions while binding retention to each step with block.
• SPEC_0032 records GitHub Releases, PyPI, and npm as canonical long-lived release registries.

Spec / MLS Alignment

• Relevant active specs checked: SPEC_0032_DEVELOPMENT_PROCESS, SPEC_0025_PR_REVIEW_PROCESS
• MLS semantics changed: no
• Owner: repository architecture hardening test and CI workflow

Risk and Design Notes

• Correctness risk: a new upload spelling/version escaping retention classification; scanner and mutations cover inline and future versions.
• Maintenance risk: new artifacts must be deliberately classified.
• New public API or migration: none.

Testing

• cargo fmt --all -- --check
• cargo test -p rumoca --test architecture_hardening_test ci_upload_artifact -- --nocapture (2 passed)
• node --test .github/scripts/msl-baseline-ratchet.test.mjs (8 passed)
• node --test packages/rumoca/tests/patch_wasm_pkg.test.mjs (1 passed)
• git diff --check; git show --check HEAD
• Not run: full Rust suite, clippy, cargo doc, hosted CI; this change is workflow metadata, one focused repository contract, and process docs. Required GitHub checks remain authoritative.
• MSL gate: N/A, no compiler/simulator semantics changed.

Code Size Budget (required)

• production_lines_added: 14
• production_lines_deleted: 0
• test_lines_added: 117
• test_lines_deleted: 0
• public_items_added: 0
• public_items_removed: 0
• files_touched: 3
• net_added_lines: 140

Net growth is the deterministic scanner/mutation guard plus explicit workflow/spec policy. No parallel implementation existed to remove; the scanner is shared by real and fixture workflows. No cleanup follow-up is needed.

Reviewer Checklist

• Relevant active specs were checked.
• MLS-sensitive change: N/A.
• Crate boundaries preserved.
• Tests prove behavior.
• Full standard CI gates pass; required hosted checks pending.
• Size budget completed.
• Positive growth justified.
• No public API added.
• No parallel paths added.
• No clippy allow added.
• Every commit signed off; no Co-Authored-By.
• No external code material copied.

ClimaMind tracking issue: https://linear.app/climamind/issue/CLI-169