build(release): prepare reproducible v4.0.1 artifacts

[cesaremcasa]

Summary

• Harden v4.0.1 release staging with a fresh temporary build context copied
  only from the Git allowlist (pyproject.toml, README/LICENSE/CHANGELOG, and
  src/atlas_wm). Build dependencies are constrained by the committed lock
  with hashes; no checkout build tree, egg-info, tests, datasets, checkpoints,
  papers, or host-specific files enter the context.
• Validate exact wheel/sdist manifests and reject duplicate, absolute,
  traversal, symlink/hardlink/special, forbidden-mode, forbidden-member,
  embedded-secret, and host-path inputs. Archives are safely inspected in a
  private temporary extraction directory.
• Canonicalize wheel ZIP and sdist tar.gz ordering, timestamps, modes,
  ownership, types, and gzip/ZIP metadata for cross-platform byte stability.
• Add manual Linux/macOS artifact matrix and hash comparison; it has no tag,
  publish, or release step. Pull requests touching release inputs trigger the
  matrix; macOS provisions the same Python 3.11.15 through uv because the
  setup-python catalog has no macOS build for that patch.
• Add focused archive PoCs and clean locked wheel/sdist install checks. No
  scientific code, models, training data, results, or checkpoint fixture was
  changed. Builds require a clean Git tree and copy blobs from HEAD, so
  stale untracked source cannot become a package input.
• Git authority is isolated from GIT_DIR, GIT_WORK_TREE, and ambient
  system/global config; repository root and full 40-character HEAD are
  verified before use. pyproject.toml, requirements.lock, uv.lock, and
  builder/SBOM scripts are byte-checked against HEAD; build constraints and
  SBOM inputs are materialized from HEAD blobs.
• The compare job validates the exact four-file staging allowlist, requires
  three 64-hex checksum entries, recomputes every downloaded artifact, then
  compares both hashes and bytes. make release-staging now defaults to a
  safe external temporary directory (or accepts an explicit external path).

Validation

• Full suite: 240 tests passed.
• Release staging built twice; wheel, sdist, SBOM, and checksum bytes matched.
• Exact staging contents: wheel, sdist, sbom.json, SHA256SUMS.
• Wheel SHA256: 4207c5fe9b4eb8f6967720f9f4dffedc73eb12ffac08c781d2cd4b049f6cfea4
• Sdist SHA256: 8302706f53a7198440273e0f7f3fe39e145e0035a0e6de6308709bcd51a39ac8
• SBOM SHA256: afeed2576f3180b4979cb2de56c34cfdcb24d1658230259753d36ecb57f67591
• SHA256SUMS SHA256: 88d483931d766a3dc4b20d90ba64c57c606459692b0cb6b752473ff729355c28
• Real cross-platform workflow run 32184058290 passed: Ubuntu job
  95863512962, macOS job 95863512815, and compare job 95863700253.
  Downloaded Ubuntu/macOS wheel, sdist, SBOM, and SHA256SUMS bytes were all
  identical.
• Wheel and sdist installed in isolated Python 3.11 environments with the
  committed lock; import/version 4.0.1, CruelGridworld core smoke, and the
  external legacy safetensors checkpoint compatibility check passed.
• CI run 32184058223 passed (Lint 95863512652, Type 95863512698, Test
  95863512658, Security 95863512639), plus CI contract, Ruff, mypy, Bandit,
  YAML parse, uv lock --check, and
  pip-audit -r requirements.lock --no-deps --disable-pip passed; the audit
  reported no known vulnerabilities.
• Final remediation commits: a3df33a and 77deeb7; final HEAD is
  77deeb7439560a40be767f51f5083abc8b1cbd6f.

Anti-regression gate

• git diff --name-status origin/main...HEAD contains only additions and
  modifications: no deletions or renames.
• No src/atlas_wm runtime module, public API, CLI, model, training path, or
  scientific behavior was removed or renamed; the source tree is unchanged
  against origin/main.
• Before/after characterization from origin/main and this HEAD was byte
  identical: version 4.0.1, seeded CruelGridworld observation shape [6],
  observation sum 67.72557067871094, legacy checkpoint model/schema, and
  state-key sample all matched.
• tests/test_release_compatibility.py tests/test_determinism_canary.py: 8
  passed; full suite remains 240 passed.

Audit note

The default pip-audit -r requirements.lock collection path aborts while
Python 3.11 macOS ensurepip creates its temporary environment (SIGABRT), so
the same lock was audited without dependency re-resolution and the installed
environment was audited with --local. This is an environment/tooling
limitation, not a suppressed vulnerability.

The earlier macOS-latest attempt was rejected before build because that
runner image has no setup-python 3.11.15; it was replaced with macOS-15 plus
uv-managed 3.11.15. Release publication remains intentionally out of scope.

Refs #56