build(packaging): assemble deterministic version payload

[sandersonstabo]

Depends on #337.

Scope

• replace the legacy two-binary portable archive with the versioned four-binary payload
• package exact Bazel-built ae.exe, editor.exe, forge.exe, and installer.exe under bin/
• generate a deterministic payload-manifest.json with SHA-256 for every declared payload file
• validate canonical, case-insensitive-safe archive paths and future declared resource/license mappings
• prove independent archive reproducibility and reject additions, omissions, collisions, and tampering

Exclusions

• release-manifest generation and detached signing
• installer download/activation smoke
• resource and license population beyond the explicit empty declarations
• remote merge or master publication

Verification

• exact four-binary Bazel build and two independent archive actions
• four focused packaging tests
• fresh direct Clippy for all nine Rust targets
• root rustfmt gate
• Cargo metadata --locked --offline
• archive and reproducibility fixture SHA-256 both 52BBAA4A62DA24DC32427CCEAA55B90A9E3D457A2242EC26F40754D129DE3AD9

Gate receipt: D:/artisan-editor-gate-logs/portable-versioned-payload-20260829-gate3/receipt.json

Remaining work

The next packet binds this archive into a canonical release-manifest.json producer and keeps detached signing outside Bazel secret inputs.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Replaces the legacy two-binary portable archive with a deterministic four-binary versioned payload. The archive now contains ae.exe, editor.exe, forge.exe, and installer.exe under bin/, plus a generated payload-manifest.json with SHA-256 hashes for every declared file.

• Generates the manifest solely from explicit Bazel file inputs; no directory, runfiles, or environment inspection.
• Validates archive member names against canonical, case-insensitive-safe Windows path rules, including reserved devices and segment length limits.
• Removes the old layout-only contract (portable_layout.txt and portable_layout.rs) and folds its validation into the new manifest generator and archive tests.
• Proves archive reproducibility with two independent archive actions, and rejects additions, omissions, collisions, and tampering in tests.
• Release-manifest generation and detached signing remain out of scope for this change.

^{Written for commit 35886ba. Summary will update on new commits.}