fix(release): recover staged publication verification

[f0rr0]

Summary

• accept only the known empty RFC3161 representation difference between actions/attest and gh verification
• bind recovery to the exact failed GitHub-staged boundary and frozen F4 payload evidence
• qualify the controller with lightweight recovery-control CI while retaining the original full-payload CI as publication authority
• preserve legacy recovery provenance and document the exact recovery rules

Validation

• focused recovery and workflow suite: 228 passed
• full release suite: 1,403 passed, 6 platform skips; the sole test-policy finding was fixed and reverified
• full policy suite: 195 passed, 9 platform skips
• workflow gates: actionlint, zizmor, 55 Node workflow tests, and 12 bootstrap tests passed
• publication-candidate verification confirms zero product-semantic changes for all 18 products
• independent correctness and security review found no blocker

Release safety

The immutable 0.1.1 payload remains sourced only from full CI run 31276212829 at ae3d29b. The controller neither rebuilds nor relabels package bytes.