[b-re-w]

Refs #20 (the PMP side; toolchain#90 consumes it, then #20 can close).

Feature added: python-multiplatform-ksp now also publishes io.github.thisisthepy:python-multiplatform-ksp:<version>:typedpython-gate@zip, the leader's option (a). At its root:

• typedpython-<v>-py3-none-any.whl, under the real wheel file name, so uv's --find-links <unzipped dir> finds it;
• typedpython-gate.json: {format: 1, typedpython: {version, wheel, sha256}, pyrefly: {version, sha256: {<wheel>: <hex>} for all 11 PyPI wheels}}.

toolchain's typedpythonCheck can then install the gate with uv pip install --require-hashes: typedpython from the unzipped dir, pyrefly from PyPI pinned by version and hash. No -Ptypedpython.wheelDir is needed.

How it is built:

• gate_bundle.py builds the wheel with uv build and writes the manifest. Zip entries have a fixed timestamp, so the bundle depends only on its inputs.
• typedpython-gate.lock.json holds pyrefly 1.3.2's PyPI digests, and the build refuses a lock whose pin differs from pyproject.toml.
• Gradle task typedpythonGateBundle declares these inputs and outputs and is attached to the Maven publication.

Tests added: test_gate_bundle.py, 5 tests.

• What they cover:
  • the zip layout;
  • the manifest against the wheel and the pins;
  • the lock against the package's pin;
  • the wheel carrying tp_runtime.h, the builtin stub and the .pth;
  • an offline uv pip install --require-hashes --no-index from the unzipped dir, then typedpython check passing on clean code.
• Red before: 3 errors (no script) and 1 pass (the lock test).

Verification (local):

• :python-multiplatform-ksp:publishToMavenLocal: BUILD SUCCESSFUL. ~/.m2/.../python-multiplatform-ksp-3.13.0-typedpython-gate.zip holds typedpython-0.1.0-py3-none-any.whl and typedpython-gate.json.
• The tests pass on CPython 3.15.0rc1t.