ci: harden automation and refresh verification evidence

[KIM3310]

Summary

• replace mutable same-release checksum retrieval with the independently verified Gitleaks 8.30.1 archive SHA-256
• stagger this repository's weekly secret scan and each Dependabot ecosystem into account-wide unique slots
• refresh the generated verification evidence from the sorted Git-tracked source inventory

Why

This removes a release-asset substitution gap, prevents 36 repositories and 108 Dependabot update jobs from starting together, and reduces transient runner/API failures without weakening any test or security gate.

Validation

• actionlint 1.7.12
• Dependabot YAML parsed; all 108 account schedules are unique and remain weekly in Asia/Seoul
• hard-coded release digest independently matched the downloaded artifact
• Gitleaks 8.30.1 local scan: no findings
• repository-surface validator (where present)
• git diff --check
• account publication generator and all central commercial validators; generator drift is zero