[codex] Document production PyPI decision gate

[stacknil]

Summary

This PR records the v0.5 PR5 production PyPI decision gate for sbom-diff-and-risk.

Production PyPI publishing is currently deferred and conditionally allowed only after the documented prerequisites are complete. The TestPyPI Trusted Publishing dry-run is treated as useful pre-production evidence, not automatic production readiness.

Scope

• Adds docs/pypi-production-publishing-decision.md for the production gate.
• Confirms the intended production package name is sbom-diff-and-risk.
• Documents the first production version rule: prefer 0.5.0 only if v0.5 is approved as the first production package release, otherwise use a later GitHub release tag.
• Documents the future publisher identity and workflow shape without adding .github/workflows/sbom-diff-and-risk-pypi.yml.
• Clarifies the boundary between GitHub workflow artifact attestations, GitHub Release asset verification, and PyPI Trusted Publishing provenance.

Non-goals

• No production PyPI workflow is added.
• No production PyPI upload is enabled.
• No CLI analyzer behavior changes.
• No SARIF, policy, or enrichment behavior changes.

Verification

• python -m build
• python -m twine check dist/*
• python -m pytest
• git diff --check
• Local acceptance check confirmed .github/workflows/ still contains no production PyPI workflow.