Make the automation release's publish-ordering rule a compile-time guard, not an assert

The assert compiled out under Release's NDEBUG and ran in no test target.
AutomationChannel::release now requires a ReleaseProof that only
publishLiveParams() or noRepublishNeeded() can mint.

src/shell/instrument/reasampler_processor.h

@@ -203,8 +203,8 @@ public:
     // voices already latched. THE tier-3 commit (the three tiers are listed in this
     // directory's CLAUDE.md). Callers pair this with setInstrumentParams exactly as they
     // paired it with reloadInstrument. No-op before anything has been decoded (the next reload
-    // bakes and publishes). UI thread; serialized against reloadInstrument's own publish.
-    void publishLiveParams();
+    // bakes and publishes). UI thread; serialized against reloadInstrument's own publish. Returns drainAutomationToModel's release proof (automation_channel.h); other callers ignore it.
+    AutomationChannel::ReleaseProof publishLiveParams();
 
     // Per-instance channel mode (mono | stereo), guarded by channelModeMutex_, never read
     // on the audio thread. Decode policy only (downmix vs L/R split) — the output bus is