Make release asset recovery idempotent

[JacobLinCool]

Summary

• verify existing GitHub Release asset names, uploaded state, byte lengths, and SHA-256 digests
• skip the 190 MB upload when canonical registry artifacts already match
• fail closed on malformed metadata while replacing only legitimate mismatches
• document and test the idempotent recovery contract

Verification

• pnpm run github:verify
• pnpm run lint
• pnpm run typecheck
• exact-match check against the published v0.1.0 Release metadata
• public npm/GitHub tarballs compare byte-for-byte and GitHub attestation verification succeeds