[codex] Verify release artifact provenance

[toby-bridges]

Summary

• add a release artifact verifier that compares the tagged audit.py blob, generated standalone output, release asset, and audit.py.sha256
• run the verifier after the draft release workflow creates and uploads assets
• document the standalone artifact provenance policy

Validation

• python -m pytest tests/test_release_artifact.py -q
• python scripts/build-standalone.py --check
• python scripts/verify-release-artifact.py --tag v2.3.0 --skip-release-download
• python scripts/verify-release-artifact.py --tag v2.3.0
• git diff --check

[toby-bridges]

Follow-up note after the ProjectRecon review feedback:

I am treating this PR as the provenance-first piece of the trust-surface work. The goal is to make the standalone release artifact verifiable from the tag, generated output, release asset, and checksum before we lean harder on public report evidence.

I am deliberately keeping telemetry out of this PR. Any usage telemetry should remain a separate future design topic, opt-in only, and blocked on provenance/report-metadata boundaries being stable first. The immediate follow-up work will be separate narrow PRs for report metadata, lower-friction local run feedback, and downstream integration examples.