Harden artifact build and publication

[KuGouGo]

Summary

• enforce Bash 5+ / Python 3.11+ and strengthen artifact directory transactions with signal-safe rollback
• retain canonical rule inputs and verify all five platform formats semantically, including real binary readback in Linux CI
• bind manifest schema v4 and publication to a consistent remote cohort, rejecting stale sources, generations, and ref races
• simplify and correct runtime, architecture, and troubleshooting documentation

Validation

• REQUIRE_SHELLCHECK=1 make validate (25/25 tests)
• make preflight (25/25 tests plus text build)
• actionlint .github/workflows/*.yml
• git diff --check

The macOS run intentionally skipped the real sing-box/Mihomo fixture because locked binary assets are Linux-only; PR CI covers that path.