Add Docker-only v0.1 evaluation and release manifest

[XnLemon]

Closes #16
Closes #17

Outcome

• move the exact product assembly and backend acceptance to Platform API /v1 and assert /v2, /v3, and /v4 return 404
• pin Core, Console, SDK, Samples, and transport candidates by full commit SHA
• add a Docker-only, one-command evaluator implemented as an isolated Docker-in-Docker image without mounting the host Docker socket
• generate fresh tokens, database credentials, Ed25519 material, and Nacos PKI for every run
• start Core, Console, two heterogeneous Runtimes, PostgreSQL, and secured Nacos; prove Register -> Discover -> Install -> Invoke -> Record; print root/parent/trace IDs and CAPABILITY_NOT_ALLOWED; clean nested containers and volumes
• add a tag release workflow that downloads and verifies component release evidence, builds/publishes Stack images with provenance/SBOM, runs the published evaluator by digest, then emits the compatibility manifest, exact command, and checksums

Local validation

• gofmt -l .
• go mod tidy
• go build ./...
• go test ./...
• go test -race ./...
• go vet ./...
• go test -c -tags=e2e ./tests/backend
• go run ./cmd/manifest-validator components.json
• workflow YAML parse and shell syntax checks

The host Docker daemon was unavailable locally. Full Compose/backend/browser evaluation and published-digest proof are required CI/release gates; this PR remains Draft until those are green and real GHCR digests exist.

Security and fallback

The evaluation profile is disposable and explicitly non-production. No production secret receives a default. No old API or component fallback was added.