release: verify and attest published release evidence

[jeremi]

Stacked on the documentation-cache PR. Implements the clean-room verifier, evidence bundle, and command-entrypoint recommendations from #427.

• adds a clean published-release verifier that starts from downloaded public artifacts and anonymous registry/package access
• validates the exact release asset contract, checksums, signatures, certificates, SLSA subjects, image locks, SBOMs, scans, labels, runtime UID, service versions, and the published registryctl authoring journey
• emits closed, public-only verification JSON without commands, environment data, logs, credentials, or local paths
• builds a deterministic release evidence bundle with lineage, run IDs, tool versions, hashes, counts, results, warnings, and held gates
• signs the verification result and evidence bundle, publishes provenance for both, and makes the final release gate verify the exact 113-asset set
• exposes the verifier and evidence flow through registry-release and checks every documented manual command against the real parser
• preserves safe rerun reconciliation for the known evidence assets

Verification:

• complete release script suite, 295 tests on the current Reduce release latency without weakening release gates #428 head
• release manual command validation
• 101-gate inventory check
• workflow lint, Python compilation, manifest/schema checks, and diff checks

The live before/after rehearsal measurement remains a post-merge operational step because it requires a real GitHub release run. Part of #427.

[jeremi]

Release and security review verdict: please do not merge as-is.

Required changes:

• Prevent stale signed evidence after an existing release asset is replaced. Either block clobbering when final evidence exists unless that evidence is removed first, or have final verification download the current pre-evidence assets and compare their sizes and SHA-256 values with the signed artifact inventory.
• Rebase onto current main after the release reproducibility work settles, dropping obsolete stacked commits and preserving the current release contract.
• Run full CI and security checks on the rebased main-targeted head.

The verifier is useful, but the stale-evidence path is a release-integrity blocker for this PR. This improvement itself is not required for beta-16.

[jeremi]

Fresh beta-16 review at head 76fbbaa: please keep this stacked draft out of the current release train.

Required before reconsideration:

• rebase onto current main after the maintenance: reduce release overhead and close Scorecard gaps #431 and docs: cache immutable archive builds #432 stack is corrected, preserving fix(release): make release builds reproducible #440, security: retire stale dependency exceptions #434, and fix(notary): avoid standalone test TCP exhaustion #443
• ensure replacing or clobbering any release payload also removes or invalidates every stale signature, certificate, provenance subject, SBOM, Grype report, checksum entry, and signed evidence bundle associated with the old bytes
• rebuild and verify the exact asset inventory from the rebased source instead of accepting previously generated evidence
• rerun release tooling, source proof, workflow CI, and end-to-end published-asset verification

This PR changes workflows, evidence schemas, and asset verification, so merging it after beta-16 preparation would invalidate candidate evidence unless the train were restarted.

[jeremi]

Closing as not planned after the post-beta cost review. Signed Releases already passes at 10/10, and the existing workflow reconciles checksums, signatures, provenance, and published assets. PR #431 replaces this large evidence-bundle design with the smaller publish-once guard and fix-forward policy.