Record verifiable demo run manifests

[amarakramali]

What changed

• write reports/sample_run_manifest.json after every successful demo run
• record effective pipeline settings and Python/dependency versions
• record byte size and SHA-256 for every generated artifact
• document the manifest and verify its contents in the end-to-end test

Why

The demo produced useful artifacts but no machine-readable record tying them
to the exact configuration and runtime that created them. Saved outputs were
therefore difficult to audit or compare later.

User impact

Every demo output directory is now self-describing. Users can inspect the
effective run configuration and independently verify that artifacts have not
changed.

Validation

• python -m ruff check src tests streamlit_app.py
• python -m pytest -q (66 passed)
• python -m compileall -q src tests streamlit_app.py
• python -m build
• end-to-end test recalculates every recorded SHA-256 and byte count