Align release docs: add validate:schemas, clarify checksum boundary, and document manual publication steps

[GsCommand]

Motivation

• Fix documentation drift where prose omitted the direct schema validation step and implied checksums.txt might be part of the hashed payload.
• Make release and onboarding instructions honest about manual publication steps (IPFS/CID/mirror) and keep cross-doc language consistent about current line v1.1.0 and legacy v1.0.0.

Description

• Updated README.md, SPEC.md, SECURITY.md, SECURITY_PROVENANCE.md, and ONBOARDING.md to explicitly reference npm run validate:schemas and to clarify that npm run validate is the umbrella command.
• Normalized checksum wording to state that checksums.txt is the generated ledger describing the checksum-covered machine-artifact set (manifest.json, schemas/v1.1.0/, examples/v1.1.0/) and is not itself part of the hashed payload.
• Added a manual publication follow-up section to ONBOARDING.md that describes IPFS pinning, CID capture, and mirror updates as manual external steps rather than in-repo automation, and asked maintainers to confirm current script names in public docs.
• Did not change schemas, examples, scripts, manifest.json, or package metadata; this PR is limited to prose alignment in the five listed docs.

Testing

• Ran npm run validate (which invokes the full suite) and it completed successfully.
• Ran the targeted validations npm run validate:schemas, npm run validate:examples, and npm run validate:integrity, and each command exited successfully.
• Performed a grep/search for the updated terms and verification commands across docs to confirm the changes are present and consistent.

---

Codex Task