ci(release): revert the VT gate to zero tolerance

The pre-release ML false-positive tolerance (single-engine Microsoft "!ml"
verdicts downgradable with Defender endpoint evidence, #1340) is reverted by
owner decision: cbm does not ship binaries carrying a VirusTotal detection,
demonstrably false or not. A "trojan" badge on a release asset is a
reputation cost the project is not willing to price in, however good the
accompanying evidence.

The gate returns to its original form: any detection, by any engine, on any
artifact, on any version blocks the release. The endpoint verification tool
and the evidence side-channel are removed with it; the notes renderer keeps
its extracted-script form but only ever states a verified "0 detections".

False positives are resolved upstream instead: verify the bytes on a real
Defender endpoint, submit a Microsoft false-positive report for the exact
hashes, wait for the detection to clear, then RE-RUN the failed verify job --
which does not rebuild, so the cleared hashes are the shipped hashes.

tests/test_vt_gate_zero_tolerance_contract.sh pins the decision: clean
passes; 1 malicious and 1 suspicious each block across stable, -rc., -pre
and -alpha versions; plus a tripwire for the specific reverted evidence
mechanism returning. Loosening this gate again has to consciously delete
that contract.

The skip_tests dispatch input and the script-extracted notes step survive
the revert -- both are orthogonal to gating policy.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

.github/workflows/release.yml

@@ -233,22 +233,18 @@ jobs:
           vt_api_key: ${{ secrets.VIRUS_TOTAL_SCANNER_API_KEY }}
           files: binaries/*
 
-      # VERSION + GH_TOKEN enable the pre-release ML false-positive tolerance:
-      # the gate may downgrade a single-engine Microsoft "!ml" verdict to
-      # TOLERATED, but only for -rc./-pre versions and only when hash-pinned
-      # Defender ENDPOINT evidence is attached to the draft release
-      # (defender-endpoint-verification.txt, from scripts/ci/av-endpoint-verify.sh).
+      # ZERO tolerance: any detection on any artifact blocks the release.
+      # False positives are resolved upstream (Microsoft false-positive
+      # submission for the exact hashes, then re-run this job — no rebuild),
+      # never by loosening this gate.
       - name: Wait for VirusTotal results
         env:
           VT_API_KEY: ${{ secrets.VIRUS_TOTAL_SCANNER_API_KEY }}
           VT_ANALYSIS: ${{ steps.virustotal.outputs.analysis }}
-          VERSION: ${{ inputs.version }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: scripts/ci/check-virustotal.sh
 
-      # Renders per-binary sha256 + VT links into the notes; when the gate
-      # tolerated an ML false positive it states that honestly instead of
-      # claiming "0 detections".
+      # Renders per-binary sha256 + VT links into the notes; only reachable
+      # after the zero-tolerance gate passed, so "0 detections" is verified.
       - name: Append VirusTotal scan links to release notes
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}