security: add verifiable release metadata and attestations

[codeforester]

Closes #195

Summary

• generate deterministic SPDX 2.3 SBOM and SHA256SUMS for reviewed distributions
• validate release metadata and bind the SBOM to the source revision
• retain release metadata as a workflow artifact and attest provenance/SBOM with OIDC on protected release runs
• document clean-room verification with hashes and gh attestation verify

Validation

• fake-distribution generation and checksum/SBOM verification
• ruff check and format
• mypy --strict for release scripts
• ./tests/validate.sh
• workflow YAML parsed successfully