feat: verify desktop release manifest

[abrichr]

Summary

• require a release manifest before a new Beta installer set can become the download-page default
• preserve the current pre-manifest Beta set until the first strict manifest-backed Beta is live
• try strict Beta candidates in publication order and retain a valid fallback when a candidate is malformed
• require the exact six installers, four metadata records, SBOM, manifest, and SHA256SUMS asset set
• reject duplicate asset names, extra assets, and mixed signing modes
• validate the exact manifest digest and every declared installer and SBOM digest in SHA256SUMS
• verify the manifest source commit against the GitHub release tag before display
• keep the release query and all manifest verification on the server

Merge sequence

1. Merge this PR after its independent review and exact-head CI pass. It preserves the current desktop-v0.15.0 pre-manifest Beta fallback, so it does not depend on a new native release.
2. Merge feat: guide qualification fault cases openadapt-desktop#102 after its independent review and exact-head CI pass.
3. Rebase ci: publish verified desktop release manifest openadapt-desktop#101 on the resulting Desktop main branch. Merge it only after all release checks pass.
4. Publish the first native release that contains the strict manifest and checksum contract. This page will select it only after all server-side checks pass.

OpenAdaptAI/openadapt-desktop#103 has merged. It uses Cryptography 50 on all platforms. The Intel audit and manual Intel source-build installer run passed.

Keep this PR as a draft until its independent review passes.

Validation

• 192 unit tests passed
• Next.js production build passed
• hosted build-and-e2e passed on exact head 119853c
• hosted CodeQL, dependency review, secret scan, and Netlify preview checks passed
• focused adversarial tests cover invalid-newest fallback, duplicate and extra assets, mixed signing modes, lifecycle monotonicity, and source-commit binding

[netlify]

✅ Deploy Preview for cosmic-klepon-3c693c ready!

Name	Link
🔨 Latest commit	119853c
🔍 Latest deploy log	https://app.netlify.com/projects/cosmic-klepon-3c693c/deploys/6a73ceb8517d09000780e7cc
😎 Deploy Preview	https://deploy-preview-355--cosmic-klepon-3c693c.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.