fix: add fail-closed v1.21.14 release finalizer

[AlexMikhalev]

Summary

• finalize v1.21.14 from a review-bound contract that pins the source commit, Cargo lockfile, cross images, staging archive, and every binary SHA-256
• securely extract an exact 18-file matrix (regular files only), assert Mach-O/ELF/PE architectures, and execute native version/command checks
• Apple-sign and notarize all nine macOS binaries with exact submission-ID evidence
• Ed25519-sign all Unix archives only when the secret key matches the public key embedded by clients
• generate valid six-target manifests before final checksums, byte-compare uploaded assets, publish from draft, and verify the final inventory

Why

GitHub-hosted builders cannot access the private Cargo registry and the Terraphim runner group correctly remains unavailable to public repositories. Build inputs therefore come from the reviewed v1.21.14 source using locked, vendored dependencies; the committed contract binds those inputs to the immutable tag. Signing credentials remain inside GitHub secrets and 1Password. The finalizer runs only from main in the repository-scoped tsm-production-release environment and fails closed before publication.

Windows v1.21.14 remains a signed-release manual download: its immutable updater cannot verify ZIP signatures, so Windows is deliberately excluded from stable auto-update manifests. That updater defect requires a subsequent source release.

Validation

• all 18 binaries report 1.21.14 under native execution or target-container emulation (Windows format validated as PE32+; Wine is unavailable)
• terraphim-agent learn --help, memory --help, and sessions expand --help pass
• 7 release-policy regression tests pass, including the real staging archive, exact inventory, symlink rejection, trusted key matching, manifest completeness, and missing-target failure
• actionlint, shell syntax checks, and git diff --check pass
• ARM64 Linux rebuild is byte-identical to the staged artifact

The existing repository CI build remains red because cargo fmt --all -- --check detects unrelated, pre-existing Rust formatting differences on main; this PR does not change Rust source.

R2 publication remains a separate verified step using ~/my_cloudflare.sh after GitHub asset finalization. No Caddy changes are involved.