feat: add NLBoot release archive inspection (sourceosctl release inspect-archive)

[Copilot]

Devtools lacked any way to inspect a local NLBoot release archive before operators attempt installation. This adds a read-only release inspect-archive command that validates presence of all required NLBoot release artifacts in an unpacked directory.

Changes

• New command — sourceosctl release inspect-archive <path> checks a directory for the five required files (nlboot-client, Cargo.lock, cargo-metadata.json, sbom.spdx.json, release-manifest.json), prints per-file ok/MISSING status, exits 1 with an explicit list of missing files on failure.

• CLI wiring — inspect-archive registered as a subcommand under release in cli.py.

• Fixtures

  • fixtures/nlboot_release_valid/ — all five required stub files; passes inspection.
  • fixtures/nlboot_release_invalid/ — only nlboot-client + Cargo.lock; fails with a clear error naming the three missing files.

• Tests — TestReleaseArchive (6 cases): valid dir, invalid dir, missing dir, file-not-directory, and both via main().

• README — commands table and running-from-repo examples updated.

Example

$ sourceosctl release inspect-archive fixtures/nlboot_release_valid
NLBoot release archive: fixtures/nlboot_release_valid
  ok  nlboot-client
  ok  Cargo.lock
  ok  cargo-metadata.json
  ok  sbom.spdx.json
  ok  release-manifest.json
ok: all required NLBoot release files present

$ sourceosctl release inspect-archive fixtures/nlboot_release_invalid
NLBoot release archive: fixtures/nlboot_release_invalid
  ok  nlboot-client
  ok  Cargo.lock
  MISSING  cargo-metadata.json
  MISSING  sbom.spdx.json
  MISSING  release-manifest.json
error: 3 required file(s) missing: cargo-metadata.json, sbom.spdx.json, release-manifest.json

No host mutation, no network access, no install behavior introduced.