Harden v0.2.0 source candidate readiness

[jacklv-coder]

Summary

• fail closed unless the only unsatisfied source gate is source-release-authorized
• emit atomic JSON verification reports with commit, archive digest, file counts, blockers, and authorization status
• retain JSON reports in candidate and trusted tag workflows without uploading source tar, RootFS, App, or binary artifacts
• document the source candidate boundary in Chinese and English

Validation

• ruby Tests/Scripts/SourceReleaseVerificationTests.rb — 19 runs, 80 assertions
• ruby Tests/Scripts/ReleaseComplianceTests.rb — 71 runs, 635 assertions
• ruby Scripts/generate-release-compliance.rb --check
• ./Scripts/check-docs.sh
• workflow YAML parse, Ruby syntax, and git diff --check
• Codex CR: no findings, patch correct, confidence 0.9
• committed-HEAD candidate report: candidate ready, exact blocker source-release-authorized, no RootFS/runtime artifact, no retained archive path

Release boundary

This PR does not create a tag or GitHub Release. It does not authorize or publish a RootFS, App, IPA, XCFramework, source tar, or binary SDK.