fix(release-evidence): emit pasteable verify commands

[arrowplum]

The "Verify it yourself" section of an evidence document listed ./verify-artifact.sh <path> lines. A reader opening the published page has no copy of that script, so the section verified nothing. Three defects, all in what the document hands a reader to run.

The commands were unrunnable. Replaced with a shell session using nothing but curl, jq and gh. It walks the digest, every repository holding those bytes, whether the seal names the file, the seal's own digest, the promotion records, the terminal attestation's back-reference to that digest, the build-info behind it, the pull request reviews, and the GitHub build provenance where one exists.

The property lookup reused the path from the digest lookup, which is the consumer-facing location. That location often carries no build.* properties: the maven, pypi and deb virtuals answer ?properties with "No properties could be found", and for a container the floating tag folder carries only docker.*. The properties sit on the timestamped path the build pushed, in a real repository. qualified() resolves there, which is pasteable() without the public-virtual preference.

The verify path could name the DEV copy of a release that reached PROD. stage_of_repo returns None for a key outside the -prod-public convention, so most_public(["ecosystem-rpm-prod-local", "ecosystem-rpm-dev-local"]) returns the DEV repo. verify_path() now prefers the repository the terminal promotion targeted, falling back to ranking. Fixing REPO_ENV_STAGE instead would shift resident_stages on every report and could change verdicts, so it was left alone.

The build lookup also names the metadata child rather than the artifact child where that is where the commit sits, since the artifact child carries no vcs block.

Opened with skip-jira, matching #303 which introduced the action.

Test plan

• 15 new unit tests covering worked-example selection, the seal and promotion steps, the metadata-child note, the substitution hint, and both path helpers. 94 before, 109 after, all pass
• The block generated for a PROD container release was executed top to bottom against live APIs: exit 0, nothing on stderr, no null or empty fields in 49 lines of output

[alexs-aero]

Looks good.

nit: we should think about rewriting this python script to use templates instead of inline HTML code generation. This will offer more human readability.