feat: add trusted provenance and release dry runs

[kiranmagic7]

Outcome

Adds the complete no-publish provenance and release foundation on top of #25.

• injects safe release versions and validates explicit non-latest runner references before Docker
• resolves and executes the runner by immutable content ID, while comparing both reference and ID
• adds a strict 14-proof release gate that rejects missing, skipped, failed, duplicated, stale, wrong-commit, and untrusted evidence
• adds a reviewed-fixture trusted-profile workflow with deterministic bundling and GitHub artifact attestation verification
• adds pinned GoReleaser and Syft archive/SBOM generation for Linux and macOS on AMD64 and ARM64
• adds a manual, protected, disabled-by-default draft release workflow with keyless signing, provenance, runner SBOM, digest signing, and no automatic trigger

Verification

• make check
• linker-injected version smoke test
• GoReleaser v2.17.1 config validation
• real local release --snapshot --clean with verified Syft v1.50.0
• all four archives, four SPDX SBOMs, and GoReleaser checksums verified

Safety and release state

This PR creates no tag, release, GHCR image, Marketplace listing, or launch state. The authorized workflow is workflow_dispatch only, requires protected main, the release environment, an exact confirmation phrase, BEHAVIORLOCK_RELEASE_ENABLED=true, and all 14 fresh proof checks. It creates a draft only after those gates. Gate 14 remains open until the trusted workflow succeeds from protected main and its bundle is independently verified.

Design issue: #18

[kiranmagic7]

Superseded by the consolidated PR #31. This branch is fully contained in the PR #31 history. Closing it to keep one active upgrade review branch. No merge, release, or launch occurred.