fix(release): verify Multipart OSS assets with CRC64

[syzsunshine219]

Summary

• keep Normal OSS release assets fail-closed on canonical Content-MD5
• verify Multipart assets with OSS x-oss-hash-crc64ecma using streaming CRC-64/XZ
• parse only the final HEAD response block and reject duplicate, missing, malformed, unsupported, empty, symlink, size-mismatched, or checksum-mismatched inputs
• record object type, integrity method, expected/actual checksum, size, and ETag in OSS_VERIFICATION.json and RELEASE_EVIDENCE.json

Regression proof

• the new workflow expectation failed against the old Content-MD5-only implementation before this fix
• release workflow and CRC tests: 27/27 passed
• packaging guards: 15/15 passed
• full lint and workflow shell syntax passed
• Project Harness Full/T3: verificationPassed=true, no failed evidence, exact HEAD 770047ce
• independent review: no P0-P3 findings

Real OSS verification

The committed verifier downloaded and validated all four current v1.1.0 Multipart installers against OSS CRC-64/XZ. A separate root-session check also matched the Windows CN package byte-for-byte against CRC metadata.

Scope

This PR changes release verification and audit evidence only. It does not create or publish a tag/Release and does not modify the active release/v1.1.0 branch. After merge, main must be integrated into the release branch and its Harness evidence refreshed before v1.1.0 is merged.

[syzsunshine219]

Project Harness review handoff marker. Only reviews submitted strictly after this GitHub timestamp qualify.