Fix cross-path release reproducibility

[justinblethrow-cloud]

Summary

The first BlackSTAR 1.0.0 publication attempt was correctly blocked by its
independent-build reproducibility gate. Bundled HTSlib embedded the absolute
checkout directory in DWARF metadata, so builds from the Actions checkout and
a detached worktree produced different binaries, SBOMs, checksums, and
archives.

This change:

• rebuilds bundled HTSlib explicitly with repository-root prefix maps
• applies the same path normalization to BlackSTAR C++ compilation
• cleans HTSlib before every release build so prior checkout paths cannot persist
• adds a reusable comparator that reports every mismatched or missing product
• makes cross-directory release reproduction a normal pull-request CI gate
• records checkout-path independence in the release policy and 1.0.0 changelog

No alignment, indexing, genome-insert, or output behavior is changed.

Failure evidence

Release workflow run
30124459260
stopped before attestation or publication.

The only binary string difference was the HTSlib compilation directory:

• /home/runner/work/blackSTAR/blackSTAR/source/htslib
• /home/runner/work/_temp/source-2/source/htslib

The failed build artifacts were retained by GitHub Actions. No GitHub release
was created.

Fix verification

Commit cb4b75b6a70722d807a0a8861e67d68b030510f1 was built from two clean
worktrees rooted at:

• /mnt/datavault/Agentic/STAR/STAR-blackstar-release-repro-fix
• /tmp/blackstar-repro-fix-source-b

Every release product was byte-identical:

• binary SHA-256: cef54809933da2801934926a7da99072bc8b936876a3d9af01f4a810a95b8737
• archive SHA-256: d9078a16e90bee75821fb9ca91a07581aa37a5ecc9fda5edfb9d37edfa645ca8

Neither binary contains its original checkout root; HTSlib records the
normalized path ./source/htslib.

Release handling

The annotated v1.0.0 tag currently identifies the pre-fix main commit, but
there is no v1.0.0 release. After this PR passes and merges, the unpublished
tag will be replaced with an annotated tag on corrected main, verified, and
the guarded publication workflow will be rerun.