fix: verify immutable release asset reruns

[codeforester]

Summary

• Permit an existing release only as a no-op rerun when release identity and the complete asset set match exactly.
• Verify tag target, package version, SBOM/BOM source identity, checksums, and uploaded asset bytes.
• Verify SLSA provenance and SPDX SBOM attestations against the repository, workflow, tag ref, and source commit before release creation.
• Fail closed with expected/observed hashes on changed or missing assets; never clobber a published release.
• Document the identical-replay recovery rule and add fixture coverage for matching reruns, tampered bytes, renamed assets, release metadata, checksums, and moved tags.

Fixes #333.

Validation

• ./tests/full_validate.sh passed: 533 tests, 193 subtests; 87.22% coverage, Ruff, mypy, docs, schemas, security, and benchmark gates.
• YAML parse and bash -n on the release job.
• Focused verifier and package-workflow tests passed.