security: bind release artifact identity end to end

[codeforester]

Summary

• require exactly one root-level archive, SBOM, provenance statement, and checksum manifest for one supported version
• validate strict SHA-256 records with complete, duplicate-free mandatory-asset coverage and safe basenames
• bind provenance subject/digest, version, source commit, and dependency identity to the selected archive and embedded release metadata
• bind the SPDX document namespace and package identity to the same version and full commit
• reconstruct and byte-compare the canonical provenance and SBOM after safe extraction and embedded bundle verification
• reject ambiguous assets, unsafe/archive-duplicate members, non-regular members, mismatched filenames, and internally inconsistent records
• exercise the verifier in the Bash 4.2 compatibility job and document the fail-closed release gate

Issue

Fixes #348

Validation

• bats tests/release-artifact.bats (7 passed, including omitted/duplicate/unsafe checksum, altered provenance subject/commit, SBOM mismatch, version mismatch, and ambiguous asset cases)
• tests/bash-42-release-smoke.sh (release guard plus canonical artifact build/verify passed locally)
• ./tests/validate.sh (567 BATS tests and every repository validation stage passed)
• bash -n scripts/release-artifact tests/bash-42-release-smoke.sh
• shellcheck scripts/release-artifact tests/release-artifact.bats tests/bash-42-release-smoke.sh
• git diff --check

Demo Impact

None.

Docs Impact

The release process now states the complete, coherent asset-set invariant and its fail-closed handling.

API Impact

No library API changes. scripts/release-artifact verify now rejects incomplete, ambiguous, noncanonical, or internally inconsistent inputs that previously passed.

CI Impact

The host runner builds a canonical fixture, then mounts it read-only into the networkless Bash 4.2 container; artifact verification itself executes under Bash 4.2 and enforces the minimum-version requirement for this trust boundary.

Security Notes

Verification no longer trusts whichever matching file or checksum rows happen to appear first. Even after an attacker recomputes external checksums, the selected archive digest, embedded version/commit metadata, provenance, and SBOM must reconstruct to the repository's canonical records.

Notes

Verification remains offline and uses only the repository's existing Bash, Git, tar, gzip, checksum, and POSIX text-tool dependencies.

Checklist

• Branch name follows <category>/<issue>-<YYYYMMDD>-<slug>.
• Branch category matches the issue's single primary category label.
• Pull request is scoped to one issue.
• Pull request body explains what changed and how it was validated.
• Relevant project checks pass.
• Documentation is updated for the release trust-boundary change.
• Applicable impact sections required by base_manifest.yaml are complete.
• Support/security claims are enforced by the minimum-Bash and release-artifact tests.
• CHANGELOG is updated for a release-worthy security change.
• Pull request includes Fixes #348.