release: bind staging to current controls

[0thernet]

Summary

• bind release verification and the mutation boundary to exact current-main controls
• detect terminal npm staging writes before job-name filtering and require one immediately preceding durable intent
• seal the sole legacy generic stage to its exact run, job, source, attempt, and outcome
• align the release and checkout-free tar readers on exact USTAR/prefix semantics with hostile fixtures

Verification

• bun run check
• independent parity review: no P0-P2 findings