Publish exact release checksums

[biru-codeastromer]

Summary

• require the release tag to match the package version exactly
• build the wheel and source archive in a clean output directory
• publish a sorted SHA256SUMS file and verify the exact remote asset set
• retain draft-first publication, immutable closure, metadata validation, and rerun checks

This supersedes #24 with a clean linear history on the protected release pipeline.

Validation

• make release-gate
• 110 passed, 1 optional skip, 91.83% coverage
• clean wheel installation, dependency audit, example, repository audit, and full-history secret scan passed

[biru-codeastromer]

Superseded by #38, which preserves the checksum contract on the organization-enforced immutable-release foundation.