ci(adr-117): kics-compatible workflow comments + fix-marker guards

- KICS error fix (.github/workflows/pip-release.yml:20): the inline
  `gcloud secrets versions access --secret=PYPI_TOKEN ...` runbook
  in the workflow header was triggering KICS' generic-secret regex
  on the literal `PYPI_TOKEN` substring. Moved the refresh runbook
  to docs/integrations/pypi-release.md (with the BOM-stripping
  `tr` step that fixed the production publish) and replaced the
  inline block with a pointer.

- Three new fix-marker guards in scripts/fix-markers.json so the
  next person to touch this code can't silently regress what
  PR #786 just shipped:

  * RuView#786-tombstone-import — the tombstone __init__.py must
    `raise ImportError`, must mention the v2 install hint, must
    point at the repo URL, AND must NOT contain `def`/`class`/
    `import wifi_densepose` (forbid patterns prevent accidental
    bloating into a real module that loads partway before failing).

  * RuView#786-tombstone-smoke-cwd — pip-release.yml must `cd /tmp`
    before the tombstone smoke-test import, because the legacy
    `./wifi_densepose/__init__.py` at repo root would otherwise
    shadow the venv install. This was the root cause of run
    26366648768; locking it in.

  * RuView#786-pypi-token-auth — the workflow must use
    `password: ${{ secrets.PYPI_API_TOKEN }}` and must NOT carry
    `id-token: write`. The project authenticates via API token,
    not OIDC; a partial OIDC migration would 403 silently.

Local check: all 25 markers pass.

Refs: docs/adr/ADR-117-pip-wifi-densepose-modernization.md
Refs: #786

Co-Authored-By: claude-flow <ruv@ruv.net>

docs/integrations/pypi-release.md

@@ -0,0 +1,64 @@
+# PyPI release runbook — `wifi-densepose` + `ruview`
+
+Operations doc for the `.github/workflows/pip-release.yml` CI workflow.
+
+## Auth
+
+The workflow uses one GitHub Actions secret named `PYPI_API_TOKEN`.
+It's a project-token issued by the rUv PyPI account with upload
+scope for both `wifi-densepose` and `ruview`.
+
+## Refreshing the token
+
+The canonical copy of the token lives in GCP Secret Manager,
+project `cognitum-20260110`, entry name `PYPI_TOKEN`. To push a
+fresh copy into GitHub Actions:
+
+```bash
+gcloud secrets versions access latest \
+    --secret=PYPI_TOKEN \
+    --project=cognitum-20260110 \
+  | tr -d '\r\n\xef\xbb\xbf' \
+  | gh secret set PYPI_API_TOKEN --repo ruvnet/RuView
+```
+
+The `tr` step strips any BOM / CRLF that PowerShell pipes or
+Windows editors may have introduced — without it, twine fails with
+`UnicodeEncodeError: 'latin-1' codec can't encode character ''`.
+
+## Triggering a release
+
+Two paths:
+
+- **Tag push** — `git tag v2.X.Y-pip && git push origin v2.X.Y-pip` —
+  publishes the v2 wheel matrix. `v1.99.0-pip` triggers the tombstone
+  job instead.
+- **Manual dispatch** — `gh workflow run pip-release.yml --ref <branch>
+  -f target=v2-wheels -f publish_to=pypi`. Use `publish_to=testpypi`
+  for a dry-run target if a TestPyPI token is also set as
+  `TESTPYPI_API_TOKEN`.
+
+## Release-day sequence
+
+Per ADR-117 §7.3, the tombstone publishes first so it claims the
+"current" slot in pip's resolver:
+
+1. `git tag v1.99.0-pip && git push origin v1.99.0-pip` →
+   tombstone live at `https://pypi.org/project/wifi-densepose/1.99.0/`
+2. Verify: `pip install wifi-densepose==1.99.0; python -c "import
+   wifi_densepose"` → ImportError with migration URL.
+3. `git tag v2.0.0-pip && git push origin v2.0.0-pip` → v2 wheel
+   matrix live at `https://pypi.org/project/wifi-densepose/2.0.0/`.
+4. (Optional, in lock-step) build + publish a matching `ruview`
+   release from `python/ruview-meta/` so the meta-package version
+   stays pinned to the same wifi-densepose version.
+
+## Off-loop manual gates
+
+- **Q3** (ADR-117 §11.3) — generate `expected_features_v2.sha256`
+  from the v2 Rust pipeline before any v2 publish.
+- **OIDC Trusted Publisher** — not used. The workflow is token-based;
+  this is a deliberate choice to keep the secret refresh entirely in
+  GCP. If the project migrates to OIDC later, remove `password:`
+  from `pypa/gh-action-pypi-publish` calls and add the publisher
+  registration on pypi.org.