fix(release): verify artifacts without Node downloader

[bkearns]

Summary

• replace the two warning-producing Node artifact downloads with a bounded GitHub API helper
• verify every API-declared SHA-256 before extraction and preserve per-artifact directory layout
• scope actions: read only to the GHCR and release consumer jobs
• add behavioral tests for successful verification, digest mismatch, missing digest, and empty artifact sets

TDD evidence

• RED: release run 33134881534 emitted DEP0005 Buffer() in both actions/download-artifact@v8.0.1 jobs despite zero annotations
• RED: corrupt/missing digests and absent helper fail the new contracts
• GREEN: all six focused workflow/helper tests pass

Verification

• independent verifier: PASS, including a separate real three-artifact digest/layout smoke
• actionlint .github/workflows/release.yml
• shellcheck .github/scripts/download-run-artifacts.sh
• bash .github/scripts/check-actions-pinned.sh
• git diff --check

Known unrelated baseline

• full tests/ci discovery has one unchanged stale nightly-fuzz step-name assertion, tracked as Forge task t_e1fdaec9