fix: verify expansion artifacts before the paper release republishes them

[magnaquant]

Summary

Follow-up to #16, closing the Medium fail-open defect found in review: the paper wrapper checked only the expansion manifest's source commit, then copied paper/expansion/results and figures into the build worktree without validating the recorded hashes, so a tampered expansion output would flow into the published PDFs (reproduced by editing a generated value with the manifest left unchanged).

• New verify_expansion_artifacts in scripts/run_paper_experiments.py: every manifest-listed artifact must exist as a regular non-symlink file at a safe relative path inside the expansion tree and match its recorded SHA-256; every file on disk under results/ and figures/ must be listed (results/manifest.json is the sole exception, as it cannot record its own hash).
• release_paper_artifacts.sh calls the verifier after the source-commit equality check and before copying; both wrappers' comments corrected (they overclaimed that only release-critical source dirt could corrupt a release).
• Nine regression tests: valid tree accepted; tampered, missing, unexpected, symlinked, traversal, and absolute-path artifacts fail closed; empty manifest rejected; wrapper calls the verifier before the copy; the committed expansion tree validates.
• CLAUDE.md documents the coordinated dependency-release flow (pyproject.toml and poetry.lock are release-critical fingerprinted inputs).
• dependabot.yml: pip version updates move to monthly grouped cadence; security alerts remain handled immediately.
• Both releases regenerated from clean source commit 34096ad, with the new verification active during the paper release (positive-path proof of the changed-source expansion-first flow).

Verification

• Tamper repro now fails closed: editing ExpansionEngineMaxDailyBp with the manifest unchanged raises "expansion artifact digest mismatch".
• Economic CSVs, figures, and target-tape hashes byte-identical; only manifests, source-digest macro, PDFs, checksums, and build manifests changed; pdftotext diff is one digest line per PDF.
• Both manifests record source_commit 34096ad with a clean worktree at start; cross-release equality holds.
• Local gates: ruff clean; 464/464 tests pass (455 prior + 9 new).
• Note: a full end-to-end wrapper test cannot run in CI (it needs the owner-supplied price matrix and pinned Tectonic); the verifier logic is unit-tested and the changed-source flow was executed for real in this PR.

Merge notes

Merge by command-line fast-forward push only (git push origin fix/release-artifact-validation:main). Do NOT use squash or the GitHub rebase button: both rewrite SHAs and would orphan the recorded source commit 34096ad. Do not move research-audit-v1.