fix(release): verify selected publication closure

[smackgg]

Summary

• validate a selective release plan against only the selected package identities while still verifying every Registry reference against exact local bytes
• retain strict product-lock validation for unselected preinstalled artifacts without requiring them in each package release plan
• publish the Nexus image-model fix as plugin v0.3.11 after the two failed recovery attempts

Why

Independent plugin publication must not require unrelated plugins to be republished. The previous verifier conflated the complete Registry with the selected release subset, then the product-lock verifier made the same assumption for FFmpeg.

Verification

• bun run check
• bun run pack
• bun run build:index
• bun tooling/publication-plan.mjs
• git diff --check

The generated release plan contains exactly plugin-nexus-service-v0.3.11 plus one Registry metadata release.