build(packaging): generate signed release metadata

[sandersonstabo]

Summary

• generate a deterministic release-manifest v1 from the authoritative four-binary payload archive
• expose detached Ed25519 signing through an explicit runtime key-file boundary while keeping signing and secrets out of Bazel actions
• publish the canonical production manifest target and focused source/behavior tests

Verification

• focused build of manifest, release tool/tests, and authoritative archive
• 6/6 focused packaging tests
• fresh direct Clippy markers for all 8 scoped Rust targets
• root rustfmt gate
• Cargo metadata --locked --offline
• generated manifest SHA-256: 6C1D9DF6338BE3803312F1E936587DF98596DE321CE2FB981EEC20165F57EBA4
• authoritative archive SHA-256: ee73b7bfd22be23cf543563b605043eae07cfe51163cfb11360d7dbad03b127d

Stacked on #338.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Generates deterministic release manifests (v1) from the portable payload archive and adds detached Ed25519 signing via an explicit runtime key file, keeping signing keys out of Bazel actions.

• New Features
  • release_tool supports generate (hermetic, no key access) and sign modes; only sign opens a key file.
  • Adds development_release_manifest Bazel target and source-level boundary tests that freeze the generate-only rule.

^{Written for commit ff54c7e. Summary will update on new commits.}