Harden release validation, CodeQL coverage, and public site checks

[masarray]

Post-merge audit findings addressed

• Expand CodeQL from Publisher-only analysis to the complete solution, including ArSubsv Subscriber and tests.
• Correct Dependabot's NuGet directory so the root Directory.Packages.props central package versions are covered.
• Add deterministic public-site validation for required assets, JSON-LD, manifest icons, sitemap, robots, and release filenames.
• Make the Npcap notice suppressible so silent installer automation cannot block on a message box.
• Run the complete release pipeline on relevant pull requests without publishing a public release.
• Validate expected portable EXEs, installer, ZIP, and non-empty file sizes.
• Smoke-test silent installation, installed files, and silent uninstallation on the Windows runner.
• Split packaging and public release publication into separate jobs with least-privilege permissions.
• Download the already validated workflow artifact before publishing a tagged GitHub Release.
• Replace the inaccurate bit-for-bit reproducibility claim with accurate validated/stable-filename wording.
• Document the new release validation workflow and Inno Setup in third-party notices.

Validation completed

All three independent checks are green:

1. CI — public-site validation, Publisher restore/build, Subscriber restore/build, tests, and dependency vulnerability reports passed.
2. CodeQL — the complete C# solution restored, built, and passed analysis.
3. Build Windows Release — portable publishing, Inno Setup compilation, artifact checks, silent install/uninstall smoke test, checksums, and artifact upload passed.

Validated workflow artifact: ARSVIN-0.0.0-pr.3-windows-x64

• Publisher portable: 73,940,755 bytes
• Subscriber portable: 73,857,739 bytes
• Suite installer: 135,617,771 bytes
• Portable ZIP: 137,013,235 bytes
• SHA-256 verification: all four artifacts passed

The pull-request workflow did not create a public GitHub Release.