Add generated Distribution verification

[woksin]

Summary

Adds the generated repository control plane required before passive review candidates can be staged. The workflow and dependency-free validator are canonical byte copies from Cratis/AI and remain outside generated package manifests.

Added

• Add seven read-only checks for exact inventory, canonical parity, native manifests, checksums, fixture provenance, scriptless package lifecycle, and rollback simulation. (Make automatic Cratis AI releases safe and recoverable AI#187)
• Validate append-only passive candidate roots, closed schema bindings, exact asset digests, all 137 component dispositions, and false authority grants. (Make Cratis AI packages work naturally across supported tools AI#188)

Security

• Use SHA-pinned Actions, read-only permissions, exact checkout SHAs, strict JSON parsing, offline npm lifecycle checks, and no credentials or publication operations.