Add post-main ACA deployment, attestation, and qualification pipeline

> Please provide us with the following information:
> ---------------------------------------------------------------

### This issue is for a: (mark with an `x`)
```
- [ ] bug report -> please search issues before submitting
- [x] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)
```

### Minimal steps to reproduce
> 1. Merge an ACA runtime change to `main` or `release/*`.
> 2. Build one immutable runtime wheel and record source SHA, version, and wheel SHA-256.
> 3. Build Linux Python 3.13 and 3.14 Flex Function fixture packages with the exact wheel and locked dependencies vendored under `.python_packages`.
> 4. Deploy each package to its protected test Function App using Flex One Deploy/config-zip.
> 5. Externally attest the deployed package/runtime, then run cold-start, public agent turn, lifecycle, backing-loss, N=5, and leak-cleanup qualification.

### Any log messages given by the failure
> N/A. Today the deployed qualification uses long-lived predeployed apps and therefore cannot prove that a remote app is running the current `main` artifact or expected Python minor.

### Expected/desired behavior
> The official `main`/`release/*` pipeline should:
>
> - remain `pr: none`;
> - publish an immutable runtime-wheel artifact with source SHA/version/wheel digest;
> - build deterministic py313/py314 Linux fixture ZIPs from that artifact without editable install or downstream dependency drift;
> - deploy and attest each matching Flex app before qualification;
> - verify commit SHA, wheel SHA, package-manifest digest, package version, and remote Python minor through an external attestation chain;
> - run cold start, authenticated model turn, suspend/resume/reclaim, backing loss, N=5, and zero-leak checks;
> - serialize py313 then py314 qualification against the shared test group to manage quota;
> - retain the previous attested package for manual rollback;
> - start nonblocking and require an explicit human decision before promotion to a blocking post-main/release gate.
>
> N=100 remains human-only and out of scope. PR-time real ACA/model smoke remains in the existing E2E pipeline and is also out of scope.

### OS and Version?
> Linux x86_64 build/deployment agents; Azure Functions Flex Consumption; Python 3.13 and 3.14.

### Versions
> ACA Sandbox preview SDK `azure-containerapps-sandbox==0.1.0b4`; runtime version produced by each official build.

### Mention any other details that might be useful

> Scope intentionally moved out of PR #160:
>
> - protected py313/py314 fixture apps and deployment storage;
> - protected variable group containing app/resource/model targets (no target URLs committed publicly);
> - dedicated deployment service connection/RBAC, distinct from ACA data-plane, controller, guest-model, and Easy Auth invoker identities;
> - immutable wheel/fixture package builder and canonical manifest hashing;
> - One Deploy/config-zip deployment jobs;
> - deployment storage blob/version/hash verification and fixture-only Easy-Auth-protected build-info response;
> - host readiness, attestation, qualification, leak reconciliation, and rollback flow;
> - official pipeline templates, static tests, and operational runbook.
>
> The fixture build-info route is not sufficient by itself: deployment jobs must download only protected build artifacts (`checkout: none`), verify artifact hashes, deploy those bytes, and compare deployment storage/version evidence with the detached manifest.
>
> Same-repository PR authors are trusted for the separate least-privilege PR smoke environment. No cross-pipeline environment lock is required by the current human decision; post-main py313/py314 stages should still run serially and use immutable per-run labels plus final leak reconciliation to avoid quota contention.

> ---------------------------------------------------------------
> Thanks! We'll be in touch soon.

Start by reviewing PR #160 and the existing E2E pipeline, then trace how official pipeline templates, protected artifacts, deployment jobs, attestation, qualification, and rollback should connect. Done means deterministic Python 3.13 and 3.14 fixtures are deployed and externally verified before serialized qualification, with leak reconciliation, rollback retention, static tests, and an operational runbook.

Written by the indexing model from the issue text.