v1.x: establish canonical trust root and exact-version online resolver

[projectious]

Extracted from the final review of #135.\n\n## Scope\n\nFinish the production trust path for bootstrap and human-facing installation:\npublish the canonical verification key and provide an exact-version online\nresolver which never silently selects a different version.\n\n## Acceptance criteria\n\n- The canonical public verification key is published from an authoritative\n project location and referenced by installer documentation.\n- Exact v1.x versions resolve to immutable release assets.\n- Missing or unpublished versions fail clearly without fallback.\n- Bootstrap verifies checksum and signature before installation.\n- Automated tests cover success, unknown version, tampered checksum, and\n invalid signature.\n\nParent: #135

[projectious]

Consolidated into #165 after scope review. Native artifact publication,
canonical trust-root distribution, exact immutable resolution, public
verification, and host smoke testing are one end-to-end release-distribution
outcome and should be implemented and accepted together.