Pin package build and upload-check tools - #313

A follow-up step in this work was policy-blocked; required CI and review remain the next actions.

CI identified two concrete follow-ups on the same PR: the binary-only flag needed a YAML block (now fixed), and Sonar requires wheel-only build/twine installs as well. I am fixing the install commands and checking the central policy failure before rerunning CI. No checks or review gates are being weakened.

Corrected head 6d5501e uses the exact centrally reviewed --only-binary :all: spelling for policy PyYAML, plus wheel-only build/twine installs. All workflow YAML parses and the current central qualification validator passes locally. This fixes the observed preflight and Sonar findings in source; CI reruns on the same PR.

Security exact-head PASS for 6d5501e1225b44613dc205a76286aa96da1c37af.

Relative to reviewed #312, the source delta is limited to three credential-free install commands. The ordinary package job and release build job now install exact top-level build==1.6.1 and twine==7.0.0; the central policy bootstrap keeps exact PyYAML==6.0.2. Every command applies --only-binary :all:, so top-level and transitive installation cannot execute an sdist build. The valid YAML block form is accepted by the shared policy validator.

The privileged PyPI job remains byte-unchanged: it installs nothing, executes no candidate source, retains the immutable artifact ID/digest/source-run checks, and alone holds id-token: write. Build, metadata comparison, twine check and package smoke remain in the unprivileged producer job before the bound handoff. The identical package-job command completed successfully on this head, and all 21 checks are green, including central policy, package, public boundary and target-branch qualification.

No Security blocker remains at this exact head. Any workflow or source change requires counter-review.

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Incorporated by release PR #314 after exact-head Security approval. The merged release contains the reviewed wheel-only tool pins, with unchanged source checks and publication gates. Closing this separate PR avoids a redundant main ancestry/CI cycle; #303 remains open until publication verifies the installed tooling path.