Fix 6.3 release scorecard environment

[zacharyr0th]

Summary

• run the A+ scorecard with all locked project extras and pinned release tooling
• make the scorecard use the Python interpreter that invoked it instead of silently switching to an incomplete local venv
• add policy coverage for the release invocation and interpreter contract

Validation

• 26 focused CI/release tests passed
• exact strict A+ scorecard replay against the successful 6.3 real-feature smoke: all_a_plus=True
• Ruff and formatting passed

[admin-raintree]

Reviewed the release-environment fix and its successful strict A+ replay.