ci: verify release assets before publication

[yaojin3616]

Summary

• fail closed before publishing a GitHub release when any expected macOS or Windows artifact is missing or unexpectedly small
• verify DMG, ZIP, and EXE signatures plus updater metadata version, size, and SHA-512 values
• harden the Jsign download step and stream large package checks to avoid excessive memory use

Validation

• npx vitest run test/verify-release-assets.test.mjs test/release.test.ts (19 passed)
• npm test -- --run (457 passed)
• npm run typecheck
• npm run build