fix: establish canonical release identity

[FernandoAbishai]

Summary

• establish one canonical productVersion/alpha releaseTag contract in scripts/release-identity.js
• source renderer/support version display from root package.json through Vite build-time substitution
• remove misleading /releases/latest renderer links in favor of the GitHub Releases feed
• keep candidate manifests product-version based and untagged; derive public filenames from validated release tags
• add source and packaged/native identity smokes, plus Phase 4B documentation/context updates

Verification

• npm run smoke:release-identity
• npm run smoke:release-metadata
• npm run smoke:public-release
• npm run smoke:release-workflow
• npm run smoke:runtime-contract
• npm run smoke:renderer-policy
• npm run lint
• npm run build:frontend
• npm run smoke:backend — 54 tests passed
• python -m compileall -q backend
• native release_candidate=true real_model=false npm run release:rc:arm64 — candidate, DMG, runtime, backend, renderer, signing-readiness, and metadata gates passed
• packaged identity: app.getVersion=0.1.0, CFBundleIdentifier=com.fernandoabishai.scriptcut, CFBundleShortVersionString=0.1.0, CFBundleVersion=0.1.0

Guardrails

• package versions remain 0.1.0
• public schema remains scriptcut.release.v2
• alpha-only support; no beta/rc/stable publication
• no product functionality, runtime contents, signing strategy, tag, or release publication changes
• no merge performed

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.