Fix release gate tooling sync

[zacharyr0th]

What changed

• install the pinned release tool requirements into the release-gate virtual environment
• keep the existing locked project and extras sync unchanged

Why

The v6.3.0 publish run built the distributions successfully, but the A+ scorecard launched scripts/build_release.py and twine from .venv, where neither package had been installed. That made package_build and twine_check fail and skipped trusted publishing.

Validation

• parsed .github/workflows/publish.yml with PyYAML
• installed requirements-release.txt into .venv with the exact workflow command
• imported build==1.5.0 and twine==6.2.0 from that environment
• git diff --check
• commit-time gitleaks scan

[admin-raintree]

Release-gate dependency fix verified against the pinned tool requirements; all required checks pass.