Harden v0.7.0-rc.2 release artifacts

[ovasylenko]

What changed

• make release.yml the single owner of GitHub Release creation and native asset uploads
• install and verify the exact tagged version in final-release smoke tests
• embed the BUSL-1.1 license in binary archives, Docker images, XCFrameworks, AARs, and generated bindings archives
• correct Android Maven license metadata
• synchronize mobile/fuzz release metadata and add regression guards

Why

The v0.7.0-rc.1 release failed because GNU binaries required a newer glibc than the Bookworm release image and the mobile workflow raced the primary release publisher without a repository checkout. Release artifacts also did not consistently carry the repository license.

Validation

• actionlint on CI, mobile, and release workflows
• ShellCheck at warning severity
• cargo fmt --check
• locked workspace and fuzz metadata
• cargo check --locked --workspace
• migration immutability and destructive-DDL guards
• release regression guard suite
• byte-for-byte AAR license test
• simulated binary tar, XCFramework, and bindings packaging