Produce immutable reproducible v31 release artifacts with provenance #20

Context

Current release automation builds/copies a binary through Docker and uploads a checksum, but does not establish reproducibility, immutable image identity, multi-architecture artifacts, SBOM/provenance, or protection from replacement on repeated release events.

Scope

• Build supported Linux architectures from the tagged commit using pinned builders/toolchains.
• Publish checksums, SBOM, provenance/build metadata, and immutable container digests.
• Ensure release event edits cannot silently replace artifacts for an existing tag.
• Add verification instructions that operators can run verbatim.

Acceptance criteria

• Artifacts embed/report the exact Git commit and semantic version.
• SHA-256 checksums cover every binary/archive.
• Container publication reports immutable per-platform and manifest-list digests.
• SBOM and provenance attestations are attached.
• A clean independent rebuild is byte-identical or any unavoidable nondeterminism is documented and minimized with evidence.
• Duplicate/replayed release events cannot overwrite an already published immutable artifact unnoticed.
• Validator installation/checksum commands are tested verbatim.

Dependency: final pins from #8 and module/release identity from #9.