fix: stamp release binary versions

[RNT56]

Summary

• validate release tags before cross-compilation and stamp main.version into every asset
• execute the Linux amd64 release asset in the tag workflow and require its reported version to match the tag
• extend the hermetic release E2E to execute the native matrix asset, reject malformed versions, and retain checksum/partial-release negative controls

Verification

• GOTOOLCHAIN=go1.25.12 make verify
• bash test/release-assets-e2e.sh
• bash test/install-e2e.sh
• malformed-version negative controls
• pinned golangci-lint (0 issues)
• govulncheck (no vulnerabilities)
• release workflow YAML parse
• git diff --check