fix: keep non-expiring admissions out of Production

[abrichr]

Problem

The current synthetic release and workflow records have expires_at: null. The lifecycle validator counted them as active even though the organization policy requires signed, expiring, and revocable admissions. The public lifecycle page then labeled all seven targets as Production.

Change

• Restore the 30-day release limit and the 7-day workflow limit.
• Verify retained signed records, but exclude a record with no valid expiry window from active state.
• Clear product Production state when no active workflow admission exists.
• Update the lifecycle page and CLI wording to describe the current records accurately.

This patch doesn't modify production-evidence/**, evidence-registry.json, or either signed admission ledger.

Verification

• python -m pytest -q tests/test_production_lifecycle.py tests/test_public_trust_schemas.py tests/test_evidence_registry.py tests/test_production_trust.py
• 127 tests passed, with 103 subtests.
• python scripts/validate_production_lifecycle.py reports 0 active admissions and 7 retained workflow records.
• git diff --check