ci: gate release assets on version and package verification

[rogerdigital]

Summary

Implements B2–B4 of the 1.0.0 release readiness plan:

• B2 scripts/smoke-installed-cli.mjs — installs a real tarball into a temp prefix (--ignore-scripts) and exercises both binaries (vault-inspector, vinspect) end to end: help, JSON scan schema/toolVersion, duplicate hash confirmation, baseline profile comparison (persisting/new/resolved), old-comparisonVersion baseline → exit 2 semantics-changed, --fail-on any → exit 1, B1 invalid config → exit 2, and vault read-only verification. Wired as npm run smoke:package.
• B3 CI verify job now uploads the packed tarball; a new installed-cli matrix job re-verifies that exact artifact on Node 18 and 24 (no build on 18). Branch ruleset now requires verify, installed-cli (18), and installed-cli (24).
• B4 scripts/check-release-version.mjs keeps package.json, lockfile root, manifest, versions.json mapping, and cli/version.ts consistent (tag argument must match on release). The release workflow now checks out with full history, verifies tag/main ancestry, and reruns lint/build/coverage/pack plus the installed-package smoke on Node 24 and Node 18 before creating the release — tag releases no longer rely on a historical passing run.

Validation

• B2 RED: smoke run against a tarball built from pre-B1 commit 69db84b failed at the invalid-config assertion (exit 1 instead of 2); GREEN on the current tree: Installed CLI smoke passed on v24.16.0 (tarball integrity sha512-ZUDJfrOoJfh8…).
• B4 RED: node scripts/check-release-version.mjs 999.0.0 exits nonzero; GREEN exits 0.
• Local gates: lint, obsidian lint, build, full test suite pass. The PR itself exercises the new CI matrix end to end.