Harden generated release and GitHub CLI delivery

[sergeliatko]

Summary

• create byte-identical LF-normalized release archives with a dependency-free stored ZIP implementation
• verify checksums, CRC values, archive inventory, staged byte identity, forbidden paths, local material, and credential patterns
• add a final-tree preflight and immutable annotated-tag state guard
• correct generated GitHub expressions and validate generated workflow portability on Windows
• install and verify the exact unpublished tag before drafting a release
• verify the published installation and a contained update from the previous release
• update active and generated workflows to actions/setup-node@v7

Validation

• npm.cmd run validate
• npm.cmd run package -- v1.3.0
• npm.cmd run release:verify-assets -- v1.3.0
• repeated packaging produced identical SHA256SUMS
• node --check passed for all changed and added scripts
• git diff --check

Closes #14
Closes #17
Closes #18

This supersedes #12 by updating both active and generated workflow copies and validating that they stay synchronized.