fix: verify release source before artifacts

[cristibleotiu]

What changed

• split immutable release checkout from release-image artifact download
• run source, license, provenance, fixture, VEX, manifest, and upstream checks before generated artifacts exist
• route signature and image scans through the validated image output from the new download step
• add a regression that enforces checkout -> source verification -> artifact download ordering

Root cause

The scheduled security workflow downloaded artifacts/image-reference.txt before running generate-source-manifest.py --check. The manifest intentionally inventories all files in the source tree, so the generated release artifact made a clean release checkout fail verification.

Validation

• red-first focused regression reproduced the ordering defect
• 83 release/SBOM/tunnel/cleanup unit tests pass
• 12,144 source hashes and 11,950 license classifications verified
• source boundary, provenance, public fixtures, VEX, exact generated-source reconstruction, and upstream provenance pass
• Bash syntax and git diff --check pass
• actionlint passes excluding only its known stale concurrency.queue syntax false positive

Scope

Workflow and contract-test only. No image, database runtime, release tag, or published digest changes.