release: add bundle size attribution evidence

[FernandoAbishai]

Summary

• add deterministic scriptcut.bundle-size.v1 measurement for the exact packaged .app and DMG
• attribute disjoint app categories, Python distributions, Torch, largest files, hotspots, hard links, symlinks, and optional baseline deltas
• integrate candidate/public maintainer evidence and concise manifest summaries without changing the six public assets
• document the logical-byte methodology and keep this phase measurement-only

Verification

• npm run smoke:bundle-size
• release metadata/public/workflow/runtime/identity/notes/published/renderer smokes
• npm run lint
• npm run build:frontend
• npm run smoke:backend
• python -m compileall -q backend
• git diff --check

Native macOS arm64 candidate and public dry-run evidence will be recorded separately. No optimization, size budget, tag, merge, or publication is included.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.