fix(ci): gate FFmpeg release staging

[smackgg]

Summary

• count selected ffmpeg-tools releases explicitly in the protected publication workflow
• stage FFmpeg source and SBOM evidence only when that exact Plugin release is selected
• add a regression test that locks both the selection query and step condition

Root cause

The Hello Convax exclusion is a Registry metadata-only publication, so dist/release-plan.json correctly selected zero package releases. The FFmpeg evidence step was gated only on the earlier PGP download and then required an ffmpeg-tools release tag, causing the protected publication workflow to fail before composing and deploying the metadata Release.

Impact

Metadata-only deployments and releases that select packages other than ffmpeg-tools can proceed without trying to mutate a nonexistent FFmpeg release directory. Actual ffmpeg-tools releases retain the existing verified source, signature, signing key, license, notices, and SBOM staging.

Validation

• bun test tooling/plugin-publication-policy.test.js
• bun run validate
• git diff --check