store#1: add secret-free catalog validation

[ksanrse]

Reviewable validation slice for #1.

• validates schema, sequence/window, unique IDs, distributions, URLs, and committed envelope shape without secrets;
• adds strict-envelope mode for post-signing byte equality;
• adds least-privilege PR/push CI and documents local usage.

Publication sequence monotonicity, replacement-chain policy, and production signing remain follow-up work.

[ksanrse]

Second pass: added catalog negative tests, ephemeral Ed25519 dry-run, replacement-cycle/integrity validation, monotonic sequence and immutable release-tag guard before signing, plus strict post-sign envelope verification and key-rotation/provenance docs. Windows checks: NOT_RUN; production signing/release: NOT_RUN (no secret/release was used).