Verify release assets before upload

[biru-codeastromer]

Summary

• build an exact wheel and source-archive set plus sorted SHA256SUMS from the protected version tag
• inherit the protected dispatch, annotated-tag, generic metadata, protected-main, draft recovery, immutable publication, and exact remote-asset contract from Publish assets before immutable release lock #35
• require draft and published release assets to match the rebuilt wheel, source archive, and checksum manifest by exact name, API SHA-256 digest, and bytes
• scope checksum documentation to releases produced by this workflow; historical release v0.2.3 remains documented as lacking SHA256SUMS

Validation

• make release-gate: 109 passed, 1 optional skip, 91.83% coverage
• committed tests cover exact artifact names, sorted checksums, missing and unexpected assets, partial draft recovery, published reruns, public metadata, and protected workflow dispatch
• all eight hosted checks pass at the exact head
• package, dependency, example, text, repository, and Gitleaks audits passed

Integration order is #35, then this PR, then #25. This PR still requires an eligible reviewer approval. No release or tag was created.

[biru-codeastromer]

Combined compatibility validation across #24, #25, #26, #27, and #28 is complete. Recommended integration order: #24 checksums, #25 attestations, #26 immutable-action audit, #27 checkout/time/concurrency hardening, #28 version audit.

The combined check found only additive prose conflicts in the shared Unreleased changelog and SECURITY text; .github/workflows/release-assets.yml combined cleanly with checksum generation, attestations, immutable pins, least persisted credentials, timeouts, and release-safe concurrency intact. Combined make release-gate: 121 passed, 1 optional skip, 91.83% coverage; version/text/repository/dependency audits, clean install, example, and Gitleaks passed. All checked commits retain the generic identity.

[biru-codeastromer]

Refreshed combined validation after the #26, #27, and #29 fixes includes YAML-semantic action scanning, YAML-semantic workflow policy tests, and exact integer KDF validation. Full stacked make release-gate passed with 146 tests, 1 optional skip, 91.78% coverage, version/repository/dependency/text audits, clean wheel/source install, example, and full-history Gitleaks. This is validation evidence only and no merge was performed.

[biru-codeastromer]

The release-documentation blocker is fixed at the new head. README now states that v0.2.3 predates the checksum workflow and has no SHA256SUMS, and scopes checksum verification to the first release produced after the workflow change. Fresh local gate: 100 passed, 1 optional skip, 91.83% coverage, clean installs and all audits green.

[biru-codeastromer]

Superseded by #36, which preserves the checksum contract on a clean linear history with the protected release controls.