fix: unify public container release verification

[resoltico]

Summary

• replace the weaker container publication verifier with the public container surface verifier in the tagged workflow
• fix native provenance probing and card-style trial-balance assertions in the public container verifier
• update the regression harness, release docs, and changelog to keep operator and automation verification aligned

Verification

• ./check.sh --console=plain
• ./scripts/verify-public-container-surface.sh ghcr.io/resoltico/fingrind 0.42.0