[codex] Fix release build dependency verification

[shadowjohn]

Summary

• Fix the GitHub Actions release build so Python 2.7, PyGTK, pywin32, pyHook, pip, and PyInstaller failures stop the job instead of producing a broken executable.
• Add a SHA256 verification gate and source notes for the vendored Python 2.7 build dependencies.
• Harden build.bat so local/CI packaging exits nonzero when TSF or PyInstaller fails.

Root cause

The v1.67 Action job continued after dependency bootstrap failures, and PyGTK was installed silently without TARGETDIR, so the packaged exe was missing gtk, gobject, and pango.

Validation

• pwsh -NoLogo -NoProfile -ExecutionPolicy Bypass -File p27\verify_sha256.ps1
• pwsh -NoLogo -NoProfile -ExecutionPolicy Bypass -File p27\test_verify_sha256.ps1
• git diff --cached --check
• Confirmed the 14 files listed in p27/SHA256SUMS.txt are tracked by git.

Notes

This PR intentionally leaves existing local dist artifacts and other untracked helper files out of the commit.