Enforce final release compliance gate

[KeyffMS]

What changed

• validate the final staged publication directory as well as the completed ZIP;
• consume the canonical package manifest, exact-version .NET metadata, license report and SPDX SBOM;
• reject missing, empty, unreadable or unresolved-template compliance files;
• verify archive naming and build metadata consistency;
• require every staged file in the archive and every shipped file in the SBOM or documented single-file container;
• prove that a deliberately incomplete package is rejected;
• fail before upload and publish a machine-readable compliance report with the verified ZIP;
• document equivalent requirements for releases, installers, store packages, portable packages and mirrors.

Scope

Release packaging and compliance only. Application behavior is unchanged.

Closes #91.