fix(release): verify artifact integrity without GUI upgrade gates

[XingYu-Zhong]

Summary

Replace the automatic post-package GUI upgrade gate with artifact integrity verification, as requested for the 0.3.8 release. The published installers still require successful quality checks, cross-platform builds, signing/notarization, and checksum verification before stable feeds or GitHub latest advance.

Changes

• Remove the automatic Windows GUI upgrade job from PR checks and the three-platform GUI upgrade matrix from stable promotion. Keep the diagnostic scripts available for manual use.
• Verify every required Windows, macOS, and Linux installer against feed size/SHA-512 and the uploaded GitHub asset SHA-256. Preserve tag/commit/draft binding, previous-feed backups, and stable/legacy feed readback before publishing.
• Accept build-specific query parameters in download URLs so rebuilt unpublished candidates do not reuse old CDN cache entries. Verification reports explicitly identify artifact-integrity coverage.
• Correct the optional macOS observer to compare canonical filesystem identities, including the Foundation /var versus Node /private/var alias, while retaining process/window checks.
• Document the revised release gates.

The existing 0.3.8 candidate at b67693f is already rebuilt and signed. Its candidate feed was refreshed with that commit as the download revision; binary bytes and their checksums are unchanged. Related release PR: #1284.

Tests

• All 85 release-workflow tests passed, including tampered bytes, mismatched GitHub digests, missing installers, unsafe download URLs, and revision-query downloads.
• Focused ESLint, file-line gate, and git diff --check passed.
• Reproduced and covered the macOS path alias issue using real filesystem aliases.
• Full application tests and all native package builds passed for the unchanged application source in release run 34010400076.