ci: publish verified desktop release manifest

[abrichr]

Summary

• publish one website-readable native release manifest with exact platform, architecture, signing state, SHA-256, SBOM, tag, version, and source commit data
• require the exact verification contract for SHA256SUMS, GitHub artifact attestation, and install, launch, and uninstall smoke tests
• require the exact CycloneDX SBOM object and format
• reject duplicate, missing, unexpected, and tampered installer entries by recomputing hashes from the staged bytes
• validate the exact SBOM file and digest and require complete agreement with SHA256SUMS before upload and GitHub artifact attestation
• document that the manifest does not claim unsigned artifacts are signed

Consumer and dependencies

OpenAdaptAI/openadapt-web#355 is merged. Its server-side consumer preserves the current pre-manifest Beta until this release contract publishes its first valid manifest. It rejects malformed strict releases and falls back safely.

#102 and #103 are merged. This branch is rebased on their resulting main branch. It uses the repaired Cryptography 50 dependency set on every platform and includes the approved qualification cockpit work.

Keep this PR as a draft until its independent exact-head review and hosted checks pass.

Validation

• 60 focused release and frozen-engine tests passed
• Ruff check passed
• Ruff format check passed
• public source-boundary guard passed
• adversarial tests cover changed or extended verification fields, the wrong SBOM format, duplicate and nonexistent names, forged hashes, platform mismatch, modified installer bytes, modified or missing SBOM, and incomplete SHA256SUMS
• the prior macOS Intel dependency audit and manual source-build installer run passed on the merged dependency repair