Migrate CLI and manifests to exact release tags

[nicodes]

Summary

• replace semantic-version resolution with exact, case-sensitive GitHub Release tags
• store the permanent tag manifest field and reject legacy version manifests with an actionable migration error
• consume and cross-check immutable registry/GitHub release identity, download by asset ID, verify SHA-256 before bounded extraction
• update publish syntax, help, docs, and focused supply-chain integrity tests

Linked issue

https://github.com/aviorstudio/gdam-be/issues/63

Risk

Risk: high — this changes package supply-chain integrity and the public CLI/API/manifest contract.

Verification

• mise exec -- go test ./...
• mise exec -- go vet ./...
• ./scripts/cli_build.sh
• merged-source pre-merge integration against https://api.gdam.dev: exact-tag add, unversioned add, install, real asset digest verification
• deliberate gate failure: changed the test fixture digest, then mise exec -- go test ./internal/githubapi -run TestDownloadVerifiedReleaseAsset$ -count=1 failed with release asset digest mismatch: expected sha256:503c8c4a78ed01824e796d9354316489417ce4f7e638592d0d3087f3e53e8588, got sha256:040a1170825ade3ff37b189dd280153ecfafb99ee929d1cbebb40fe135afdf26; reverted and reran green

Team No Review: review and approval gates are intentionally skipped.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}