Harden downloadable release verification

[xiaohei210509]

What changed

• verifies the exact ZIP contents before tagged releases are published
• removes extended metadata before strict signature checks
• checks the packaged build number and app version
• clarifies the Chinese redaction wording as risk reduction rather than a guarantee

Why

The beta artifact is already valid, but future release CI should verify the same archive users download rather than only the pre-compression app bundle.

Verification

• workflow YAML parses successfully
• checksum, extracted Info.plist, strict codesign, and arm64/x86_64 checks pass locally
• git diff --check passes
• Private Vulnerability Reporting is enabled for the repository