fix(release): verify signatures on fresh runner

[AlexMikhalev]

Summary

• keep candidate assets in a private draft after signing
• verify checksums and all nine macOS signatures in a second ephemeral macOS job
• move the sole publication mutation behind that fresh-consumer gate
• restore the reviewed staging asset if final inventory or publication fails

Incident addressed

The signing job imported the legacy Apple Developer ID G1 intermediate. Its securityd trust state allowed same-job verification to pass, while a fresh consumer Mac rejected the byte-identical binary. This job boundary prevents signing credentials or trust cache from masking that failure.

Validation

• python3 -m unittest tests.test_release_finalizer_contract (8 passed)
• actionlint .github/workflows/finalize-prebuilt-release.yml
• git diff --check
• independent fresh download reproduced the defect and release was returned to draft before Cloudflare publication