Fix release verifier cache cleanup

[fxdv]

Root cause

The v0.1.3 public artifacts, checksums, provenance, archive execution, and Go installation all succeeded. Go stores downloaded modules read-only. The verifier's final rm -rf therefore returned non-zero, causing a successful go install @v0.1.3 check to be retried and eventually reported as failed.

Fix

• make only the verifier-owned temporary install tree writable before deleting it
• add a regression test using a read-only simulated module cache
• make workflow_dispatch a verification-only recovery path for an existing published immutable tag
• use the corrected verifier from main during recovery without rebuilding, retagging, or republishing release assets
• allow an explicit recovery input to check @version and @latest only when the recovered tag is current

Validation

• release tooling regression test
• Shellcheck for changed scripts
• release workflow YAML parse
• git diff --check
• independent public verification confirmed v0.1.3 archive provenance
• fresh go install ...@v0.1.3 reports patchlog v0.1.3
• fresh go install ...@latest resolves to and reports patchlog v0.1.3

Rollout

After green PR and post-merge main CI, dispatch Release from main with tag v0.1.3 and verify_module_installs=true. The recovery must verify the existing immutable release without mutating it.