security: verify published PyPI bytes against reviewed release assets #489

Goal

Detect a registry-side publication mismatch by comparing the bytes users receive with the reviewed release artifacts.

Scope

• Extend post-publication verification beyond version and README metadata.
• Read PyPI JSON file hashes for the released wheel and sdist.
• Compare them with SHA256SUMS, the GitHub release assets, and the release BOM.
• Fail the release workflow and raise an actionable incident if any file is missing, extra, renamed, or hash-mismatched.
• Document the consumer verification command and retain machine-readable evidence.

Acceptance criteria

• A successful release proves byte equality between the reviewed artifacts, GitHub release assets, and PyPI files.
• A simulated missing, extra, or modified PyPI file fails the verifier.
• The verifier remains retry-aware for normal PyPI propagation delay.

This is a v1.0 release-integrity follow-up.