ci: post-release verification job (attestation + pkg.go.dev)

[millerjp]

Summary

proxy-warm only pings proxy.golang.org. Nothing verifies the end-to-end release: attestation validity, checksums match, pkg.go.dev has indexed the version.

Scope

New job post-release-verify in release.yml, needs [goreleaser, proxy-warm], if: inputs.dry_run != true:

1. gh release view $TAG --json assets — expected assets present.
2. Download tarball + checksums.txt, verify SHA-256 match.
3. gh attestation verify syncmap-*-source.tar.gz --owner axonops exit 0.
4. Poll pkg.go.dev/github.com/axonops/syncmap@$TAG for 200 within 5 min.

Acceptance criteria

1. Job green on v1.0.1 release.
2. Job fails clearly on any mismatch.

Source: devops agent.