fix: scope release evidence requirements to affected hosts

[jeremymcs]

Release validation previously required fresh live receipts from every host for every version. This change selects required hosts from changes since the previous reachable release tag, excluding the current version tag.

• Host adapter changes require the affected hosts. Shared contracts, unknown paths, and missing or shallow history require all hosts.
• Documentation, tests, CI, daemon, release tooling, and version-only package metadata changes do not require fresh live runs. Automated checks remain mandatory, and required receipts retain their existing proof checks.
• Release documentation now points to the updated policy.

Validation: 44 trust tests, four workflow tests, and 24 executable CLI probes passed. Regression tests failed before the fix; sabotage checks caught forced all-host requirements and disabled required-host checks. All seven PR checks passed, including Node 18 and Node 20 verification.

Release 1.2.0 still requires current evidence from all 11 hosts because it contains shared pipeline changes since v1.1.0. No release was published and no new native-host runs were performed.