Add development artifact warehouse catalog and manual tooling - #5

Outcome

Turns effectstream/binaries into the self-documenting metadata/manual-promotion surface for the permanent mutable development warehouse at 0.3.120.

• backfills all 66 existing assets with exact GitHub identities, independent SHA-256, bounded archive member/layout/mode inspection, and explicit legacy provenance/anomalies
• adds strict catalog/snapshot/receipt/journal/live-evidence schemas, published-only resolver/index, reviewed-base transitions, established family/selector/coverage rules, selected toolkit/Q8=B contracts, and Compact rejection
• adds the warning-first eleven-part README plus temporary owner MACOS.md
• consumes the exact audited forge promotion protocol and separately enforces the audited component-policy remediation pin
• adds complete FR-039 snapshot/current-baseline drift, zero-write preflight, fresh host/API candidate verification, create-only manual upload, authenticated resume lineage, reconciliation, and full read-back tooling
• adds read-only CI, native macOS/minimal-container heartbeat portability fixtures, and executable clean-room/adversarial transaction tests

Safety boundary

DEVELOPMENT ONLY — NOT FOR PRODUCTION USE. 0.3.120 remains mutable; consumers must verify committed SHA-256 before install or execution.

This PR changes repository metadata/docs/scripts/workflows only. It does not edit the release body or create, replace, delete, or upload any release asset. Destination Actions retain contents: read and contain no release-write path.

The manual uploader has no overwrite/delete/clobber path; stable published metadata stays last after full independent read-back. Candidate bytes remain inert. A live candidate requires fresh github.com API/download evidence plus cryptographic gh attestation verify; the deterministic noncryptographic forge fixture is admitted only through its exact pinned test-only path/marker.

Verification

• independently downloaded and hashed all 66 assets: 3,750,374,517 bytes, all API/download digests equal
• bounded-inspected 6,201 archive members; 22 legacy AppleDouble anomalies retained/cataloged, not republished
• network-isolated Docker Python 3.12: exact catalog plus 43/43 semantic/clean-room/auth/manual/proof/workflow tests PASS
• exact isolated forge protocol 2052e6e… + component-policy ddd2838… fixture passes through the receipt binding gate
• digest-pinned Alpine 3.22.1 heartbeat PASS without GNU date -d; native macOS and Ubuntu heartbeat jobs are included
• actionlint, JSON/Python syntax, Bash syntax, and diff-check PASS
• live read-only API check: exact release ID/node/tag, empty body, and 66 assets; no release mutation

Audit status

Independent review froze F1–F15. F1 was resolved at the prior head; this exact head consolidates all 14 remaining F2–F15 groups / 28 atomic gaps and is awaiting the final exact-head replay. Release/body/asset mutation remains prohibited until that audit passes.