ci: verify the installed artifact before publication

[jdsika]

Summary

• Share one fresh-environment wheel verifier between CI and publication before artifact upload.
• Check archive/installed identity, public version, package origin, typing marker, and unchanged wheel bytes.
• Execute documentation examples from the selected package target and validate explicitly classified signature blocks.
• Cover malformed artifacts, command failures, option isolation, digest changes, and documentation classification.

Verification

• Source suite: 890 passed; coverage 95.89%.
• Artifact/documentation focused suite: 48 passed in each source and installed mode.
• Shared-verifier end-to-end run passed with hostile path and pytest environment overrides.
• Real missing-module and missing-typing-marker wheels were rejected without source rescue.
• Ruff, mypy, build metadata checks, and independent adversarial review passed.
• No package publication performed.