[codex] harden artifact-mode deploy execution

[aron23]

Summary

• harden release-asset install and stage-stack artifact-root propagation so --release-dir no longer depends on repo-local bin/*.zip
• add real stage-stack synth and lesser up --release-dir regressions that fail when the artifact root is dropped or deploy prep falls back to checkout-local assets
• add an explicit artifact-driven deploy certification script and run it in both CI and release publication

Why

Issue #658 tracks the remaining artifact-mode gaps that recent managed updates exposed. A valid Lambda bundle was still vulnerable to inventory-order drift, and the real stage-stack path could still synthesize against checkout-local zip assets when lambdaAssetRoot was not threaded through the full stack path. This PR closes those gaps and makes the certification signal explicit for managed consumers.

Validation

• ./lesser verify ci
• bash scripts/verify_artifact_deploy.sh

Closes #658.
Closes #659.
Closes #660.
Closes #661.
Closes #662.
Closes #663.