Add a versioned release-bundle manifest

[Staphylococcus]

Parent: #91

Outcome

Give each release bundle a deterministic machine-readable identity that can be checked against GitHub release metadata and the bundled binary before anything from the archive is executed.

Scope

• Add a schema-versioned manifest to generated release bundles.
• Record the release tag, semantic version, release channel, target triple, and tagged commit.
• Define canonical field formats and reject missing, duplicate, unknown-critical, or inconsistent identity data.
• Validate the manifest against the bundled lg-buddy --version output during bundle construction and smoke testing.
• Include the manifest in expected bundle layout and release documentation.
• Keep the manifest focused on candidate artifact identity rather than host upgrade eligibility.

Acceptance criteria

• Official bundles contain a deterministic manifest with version, channel, target, tag, and full commit identity.
• Manifest identity agrees with the release tag and bundled binary.
• Missing, malformed, version/channel/target/commit-mismatched manifests fail bundle validation.
• Release-bundle build, archive layout, publish dry-run, and focused smoke coverage pass.

Out of scope

• Installation receipts or installed-state provenance.
• Determining whether the current host is upgradeable; tracked in Add runtime host upgrade compatibility preflight #100.
• Network download and GitHub asset verification; tracked in Download and verify release bundles securely #97.
• Applying an upgrade through lg-buddy updates install.