Lock dependencies and make published releases immutable

[masarray]

Purpose

Complete all P1 hardening items from the latest repository audit.

Completed changes

Documentation consistency

• Synchronize README, build/release documentation, contributor guidance, source-version examples, repository structure, and current coverage baselines.
• Document the shared ARSVIN.Engine assembly accurately, including the staged physical source migration.
• Document immutable-release behavior and the locked dependency update workflow.

Immutable public releases

• Add a release preflight that queries the GitHub Release API before attestation or upload.
• Fail publication when a GitHub Release already exists for the semantic-version tag.
• Require corrections to use a new patch version instead of replacing existing binaries, checksums, SBOMs, or attestations.

Locked NuGet dependency graph

• Enable RestorePackagesWithLockFile repository-wide.
• Commit generated lock files for Publisher, Subscriber, the shared engine, and Tests.
• Include the Windows win-x64 runtime graph used by the self-contained release build.
• Declare win-x64 as the supported runtime graph for Publisher, Subscriber, and the shared engine.
• Enforce --locked-mode in CI, CodeQL, build.ps1, coverage tests, and release publishing.
• Upload committed lock files as CI evidence.

Validation completed

• Locked solution restore: success.
• Publisher warning-free build: success.
• Subscriber warning-free build: success.
• Unit tests and protocol-core coverage gate: success.
• Public-site build and recursive validation: success.
• Publisher and Subscriber vulnerability reports: success.
• Full-solution CodeQL with locked restore: success.
• Locked win-x64 Publisher and Subscriber publish: success.
• Inno Setup installer compilation: success.
• CycloneDX SBOM generation and validation: success.
• Silent installer and uninstaller smoke tests: success.
• SHA-256 checksum generation: success.
• Private release artifact upload: success.
• Public release job on the PR: correctly skipped.

Validated private artifact: ARSVIN-0.0.0-pr.54-windows-x64, digest sha256:938ebf2d4f8695be21e02b3bb359eb60555d804ffce3d41e6dfa29e7d8a1e59c.

No public release is created by this pull request.