Verify published releases end to end

[owieschon]

What changed

• make pipx install sourcebound the canonical install path and test it against the candidate wheel offline
• publish every tagged wheel to PyPI with rerun-safe immutable-version handling
• compare local, GitHub, checksum, and PyPI bytes after publication
• verify GitHub attestation plus fresh pipx and uv installs
• upload typed success or failure receipts
• separate artifact verification from the installation lifecycle guide

Verification

• full pytest suite
• mypy and ruff
• Sourcebound audit, check, verify, verdict, evaluation, review lifecycle, and trusted self-check
• live v1.2.1 publication verification across GitHub, PyPI, pipx, and uv
• offline README quickstart through a real pipx environment