Unify legal bundle and final package verification

[KeyffMS]

Scope decision

SightAdapt currently maintains one binary format: the self-contained Windows x64 portable ZIP. The GitHub Actions artifact and a maintainer-created local ZIP are the only active producer contexts. GitHub Releases, installers, store packages and official mirrors remain planned/inactive channels and are tracked separately.

What changed

• add release/distribution-channels.json as the maintained/planned channel registry;
• add tools/new-verified-release-package.ps1 as the only maintained package-creation entry point;
• add tools/verify-final-package.ps1 as a reusable gate over the existing legal, SBOM, license and component validators;
• compare every staged file with the corresponding ZIP entry by SHA-256;
• record source commit, repository HEAD, source ref, optional tag, workflow/run identity, channel, format, archive size/checksum and per-file evidence in schema-3 compliance reports;
• require commit SHA to match checked-out HEAD and tag to match refs/tags/<tag>;
• reject planned channels until their implementation activates the registry entry;
• switch GitHub Actions to the shared package entry point;
• add negative tests for modified archive bytes, incorrect commit provenance, inconsistent tag/ref provenance and inactive GitHub Release publication;
• document the formally narrowed maintained distribution scope and future activation requirements.

Verified result

GitHub Actions run 30544829871 passed DCO, 210 tests, exact notices, 452 component mappings, complete SBOM/license review, all previous negative tests and the new final-package tests.

The final schema-3 report records:

• result: pass;
• channel github-actions-artifact;
• format portable-zip;
• source commit and repository HEAD e4283731dad650a9259a211ce3dd08f2a4d9b9e6;
• source ref refs/pull/144/merge;
• workflow run 30544829871, attempt 1;
• 17 staged/archive file records, all SHA-256 matches;
• archive SHA-256 BCCDAB8135DE1D539DFE8A750E13F6B603C1B2870CE36AC5E7042DF2495471D0;
• base compliance, component coverage and staged/archive hash comparison all pass.

Negative validation rejected:

• modified PRIVACY.md bytes by staged/archive SHA-256 mismatch;
• an all-zero source commit because it did not match repository HEAD;
• an inconsistent release tag/source ref;
• the github-release channel because it is planned but not maintained.

Boundaries

This PR does not publish a GitHub Release, create an installer/store package or configure a mirror. Those channels remain inactive until their own implementations use the reusable gate and retain the verified package/report.

Closes #82.
Closes #91.