feat(release): generate the upload plan from canonical sources, never by hand

`sc album --plan` wants titles, files and tags as JSON. Typing that by hand is
exactly how a release ships with the wrong album name — split_bandcamp.py once
carried an ALBUM string that was simply wrong and nothing downstream could tell.

So build_release_plan.py generates it, and every field is copied from the one
place that owns it: gig metadata from Web/www content/lives/{year}/{slug}.md,
per-track section/style/sample-banks from that gig's tracks.json, release order
and durations from the rendered segments, approval from the ear file's
release_signoff. `_provenance` records each source, so a wrong string is traced
rather than argued about.

TWO REFUSALS, both because the failure they prevent is invisible after upload.

1. NO SIGNOFF, NO PLAN. The ear file's release_signoff is pinned to the segments
   PLN approved; if it is missing, or the rendered FLACs are NEWER than it, the
   record on disk is not the record he cleared. An upload is hard to take back,
   so the check belongs before it and not in a checklist. --force overrides and
   says so in the log.

2. NO ROW, NO PLAN. The first run joined the tracklist on the raw title and
   silently missed 4 of 14 — because the canonical names are written in PLN's
   blog voice ("There's **Something About Drums** <3", "Am i _Doing it Right_",
   "GHOSTS IN THE TOILETS") while the segments carry the plain form. The plan
   looked complete: 14 tracks, right durations, right files. Four of them just
   had empty genre, empty section and NO sample banks — and the sample-bank list
   is the input to the rights question. A parser miss must never become a quiet
   gap in the catalog, so an unmatched title now refuses the whole plan and
   prints both name lists side by side.

The fix for the join itself is match_key(): strip emphasis, hearts, case and
punctuation for MATCHING ONLY, while every value that ships still comes from the
canonical record verbatim. Which surfaced a real question rather than hiding it
— the two sources disagree about three names, so --titles chooses, defaulting to
canonical, and the diff is printed:

    "There's Something About Drums" -> "There's Something About Drums <3"
    'Perfect'                       -> 'Perfect <3'
    'Ghosts in the Toilets'         -> 'GHOSTS IN THE TOILETS'

Those decorations are his voice, not markup, and clean_title already knew to
keep them. Verified against the shipped audio: 14 tracks, durations matching the
rendered files including CRIME's 2s rest (271.1s) and REVOLUTION's reverb tail
(205.6s). Every track carries `_rights_checked: false` — the banks are listed,
nobody has cleared them.