Add release governance and PyPI trusted publishing

[Codeblin]

Summary

Prepare DexMachina for a credible v0.1.0 public alpha by adding release governance, supply-chain documentation, CI hardening, PyPI Trusted Publishing support, and cross-platform test fixes.

This PR also improves download integrity handling, lockfile reproducibility, emulator CI diagnostics, and the Frida device-ready flow.

Testing

• python -m pytest
• dexmachina --help
• dexmachina status --offline

Additional validation:

• py -m pytest -> 132 passed
• py scripts\verify_release.py v0.1.0
• py -m uv build
• Verified workflows contain no external uses: actions

Device or Emulator Coverage

If this affects device flows, note what you tested:

• Setup: GitHub Actions rooted AVD workflow, shell-only because repo policy blocks external actions
• Rooted: CI attempts adb root and then runs device readiness checks
• Command: dexmachina --no-banner up --profile minimal --yes, dexmachina --no-banner device ready, dexmachina frida-ps -U
• Result: Workflow has been iteratively fixed for SDK bootstrap, AVD visibility, emulator boot diagnostics, and active Frida venv resolution

Supply Chain Impact

• No new downloads or network calls
• New/changed downloads are documented in THREAT_MODEL.md
• Checksums/signatures were added when upstream provides them

Notes:

• Direct and GitHub Release downloads now record SHA-256 metadata.
• Restore enforces lockfile SHA-256 digests for direct/GitHub Release artifacts.
• GitHub Release checksum discovery supports common upstream checksum assets.
• Signature verification is still documented as a future gap.
• PyPI publishing uses Trusted Publishing/OIDC via uv, avoiding long-lived PyPI tokens.