Validate exact ceremony-kit binary pairs

[mellowcroc]

Summary

• add a binary-only compatibility gate for exact Relay and mpc-ceremony release artifacts
• require the gate during ceremony-kit assembly and bind its evidence to both SHA-256 hashes
• add a manual release-pair workflow with repository, tag, and hash inputs instead of a proof-tool commit pin
• document independent project releases and operator verification

Relay CI remains independent from proof-tool and uses a local CLI-contract fixture.

Validation

• go test ./...
• go vet ./...
• ShellCheck and bash -n
• Actionlint
• real Relay + real mpc-ceremony binary compatibility exercise
• compatible fixture accepted and incompatible binary rejected
• ceremony-kit assembly and setup verify