Make Shoal compatibility upgrades safe

[phrocker]

Summary

• make ordinary sharkbite==1.2.0.3 to 1.3.0 pip upgrades preserve the Shoal-backed import package
• install only a synchronized sharkbite/__init__.py compatibility facade after the exact Shoal dependency
• extend the package path so split user/system installations still locate Shoal modules
• replace the local implementation stub with the published same-version Shoal wheel
• add clean-install, real historical-upgrade, already-satisfied dependency, split-site, RECORD ownership, and initializer-parity gates
• require release tags to come from main
• correct repository and release documentation for the new ownership boundary

Root cause

Modern pip installs dependencies before dependents. The metadata-only bridge allowed shoal-sharkbite to install sharkbite/__init__.py, then pip uninstalled historical sharkbite==1.2.0.3 and deleted that same path. Both distributions remained present and pip check passed, but imports were broken.

The bridge now writes the initializer last. Its Shoal-derived body is verified against the exact implementation wheel; only a fixed pkgutil.extend_path preamble may differ. Shoal continues to own every implementation module, pysharkbite, and native artifact.

Validation

• clean wheel/sdist build and strict archive verification
• actionlint 1.7.7
• real Docker Python 3.9 upgrade from the public sharkbite==1.2.0.3 wheel
• upgrade when shoal-sharkbite==1.3.0 is already installed
• split-site import with the bridge and implementation in separate package roots
• pip check, public API identity, native ownership, and direct RECORD ownership assertions

Release recovery

The existing Sharkbite v1.3.0 workflow failed before PyPI publication, so the version remains available. After this PR merges, delete/recreate the Sharkbite v1.3.0 release and tag at the merge commit; do not rerun the failed workflow against the old tag.