v1.x: complete trusted four-platform release distribution

[projectious]

Extracted from the final review of #135. Consolidates former issue #166.

Scope

Complete the production release and trust path for all supported targets:

• x86_64 Linux
• arm64 Linux
• x86_64 macOS
• arm64 macOS

The local candidate must remain evidence-bound. Host jobs must verify branch,
commit, and tag provenance before building. Human-facing installation must use
a canonical verification key and exact immutable version resolution, never a
floating or silent fallback.

Acceptance criteria

• All four native artifacts are attached to a v1.x prerelease.
• Exact v1.x versions resolve to immutable release assets; missing versions
  fail clearly without fallback.
• The canonical public verification key is published from an authoritative
  project location and referenced by installer documentation.
• Bootstrap verifies checksum and signature before installation.
• Checksums and signatures are verified from public downloads.
• Each artifact passes an install and smoke test on its target platform.
• Release evidence records the source commit and host runner provenance.
• Automated tests cover successful resolution, unknown versions, tampered
  checksums, and invalid signatures.
• Release documentation describes recovery for failed host builds.

Parent: #135

[projectious]

Release policy clarification from the project owner: processkit must not use GitHub Actions, workflow files, hosted builds, or hosted documentation generation/deployment. PR #176 enforces this. The release tooling is complete for local multi-host production: each maintainer-controlled target host runs release-host/build-host-artifact.sh against the exact tag and source SHA, producing a native binary, checksum, smoke result, and local host provenance for final collection/signing. This issue remains open until artifacts from local x86_64 Linux, arm64 Linux, x86_64 macOS, and arm64 macOS hosts are actually collected, publicly verified, and attached to the prerelease.