Harden GitHub release controls

[alphadelta332]

Summary

• Pin GitHub Actions by full commit SHA and restrict workflow permissions
• Verify release tags originate from main
• Publish SHA-256 checksums and a machine-readable release manifest
• Document private vulnerability reporting and post-merge tag creation

Repository controls applied

• Protect main with required PRs and Release metadata checks
• Protect v* tags from deletion and rewriting
• Enable immutable releases and private vulnerability reporting
• Require SHA-pinned GitHub-owned Actions

Validation

• Local action pin and release-integrity workflow checks passed
• git diff --check passed with line-ending warnings only