Retry immutable GDAM publication safely

[nicodes]

Tracks the release blocker on https://github.com/aviorstudio/fieldsofrevik/issues/143.

Recovery contract

• Adds an explicit retry mode to the existing release workflow.
• Requires an exact existing semver tag and 64-character SHA-256.
• Resolves the immutable tag target, requires it to match the GitHub Release target, downloads the existing asset without rebuilding, verifies the relative checksum and GitHub asset digest, and transfers those same bytes to the isolated publish job.
• Does not move/delete tags, replace assets, or create another release in retry mode.
• Installs checksum-verified GDAM v0.0.8 and retries only registry publication.

Team No Review evidence

• Existing tag: v0.0.3; target b43240fdb98b2e14cdeeb5ad6117b6da9d034530.
• Existing asset ID 560835391; SHA-256 22d4c1d4c7b501bd72775b14f9b3b60445d20b89ee66e19f91fef8289065b551.
• Positive control resolved the tag and required matching release target and API digest.
• Wrong target and wrong digest are direct failing assertions in the same test-job recovery gate; publication is unreachable until all four reachable assertions pass.
• Original release test/package job already passed at the immutable tag target in run https://github.com/aviorstudio/gd-env/actions/runs/34746661038; recovery deliberately reuses rather than falsely rebuilding those bytes.
• Exact-head CI for this workflow change: pending.
• No reviewer or approval wait; merge immediately after green exact-head CI.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[nicodes]

Exact-head CI https://github.com/aviorstudio/gd-env/actions/runs/34747001605 passed at 1252b20aa6fc1cec48147db01e6e9360a0e39eb7, reaching the unchanged behavior/package/Web gates. Immutable-release recovery assertions were also exercised locally against v0.0.3 target b43240f... and asset digest sha256:22d4c1.... Team No Review gates pass; merging immediately.