fix(release): harden successor compatibility mirror

[yaacovcorcos]

Outcome

Hardens the one-time compatibility path that lets installed legacy Scient clients receive an already-published successor build without rebuilding it in this repository.

Changes

• require execution from the exact current legacy main workflow
• reject a moving main, mutable version, existing tag, or existing release
• verify the source release is stable, non-draft, non-prerelease, and current Latest
• prove the source tag resolves to the exact commit in the successor handoff
• verify every handoff SHA-256 plus every updater payload size and SHA-512
• require complete macOS arm64/x64, Windows x64, Linux x64, and server assets
• create only byte-identical legacy manifest aliases
• stage a draft mirror, download and byte-compare it, then make it public

Verification

• bun run fmt:check
• immutable-workflow-action check
• scripts typecheck
• focused mirror tests: 4 passed
• mirror workflow YAML parse
• git diff --check

No release, tag, mirror publication, or production setting was created or changed.