Regenerating the interop wrapper now records itself in the manifest

[chrisholloway5]

Two steps that must always happen together are one step.
build/regenerate-interop.ps1 runs TlbImp against the Release type library
and rewrites the wrapper's SHA-256 and size in
hmailserver/docs/third-party-binaries.json in place, keeping every other
byte of the manifest as it was. Doing only the first half by hand failed
the binary-provenance check twice on 21 August - after two different
people had each done it correctly.

Its staleness guard does not trust mtimes: git bumps them on every
checkout and merge, and the first version of the guard refused a type
library that was in fact current because yesterday's fast-forward had
touched the IDL. It now asks git - uncommitted edits newer than the
library, or a last commit newer than the library - and either answer of
stale is final. It also prefers the intermediate .tlb MIDL just wrote
over the staged copy, because build.ps1 suppresses the post-build event
that does the staging.

RELEASE.md now describes the pull-request flow master's ruleset requires

• push the branch, gh pr create, gh pr merge --rebase - rather than the
  direct push the ruleset exists to refuse. The maintainer's bypass
  announces itself at push time; the docs say to treat that as a mistake
  to correct.

ci.yml and the roadmap record the tested answer on the Code quality
setting: coverage upload works with the setting configured and no
languages, but the setting being on at all re-exposes the 1,482 stale
findings of the scan switched off on purpose, so it stays off and the
build artifact is the coverage record.