feat(release): deliver Phase 11 release engineering

[ZSeanYves]

Summary

• complete PR-110 through PR-114: Mooncakes metadata/API docs, MoonX staging, policy tiers, cross-platform candidates, supply-chain evidence, and upgrade/rollback rehearsal
• add deterministic Native/wasm1 candidate artifacts with checksums, CycloneDX 1.5 SBOM, SLSA v1 provenance, exact dependency/license audit, OIDC attestations, and seven-class tamper rejection
• extend CI with Linux/macOS/Windows candidate build and verification, with all Actions pinned to immutable commits

Verification

• moon info && moon fmt
• ./tools/check.sh
• 303/303 Native tests
• 298/298 wasm1 tests
• official CycloneDX 1.5 JSON schema validation
• shellcheck, Python compile, TOML/YAML parse, immutable Action SHA verification

Publication boundary

This PR prepares, validates, temporarily uploads, and attests release candidates only. It contains no moon publish, tag creation/push, GitHub Release creation, publishing credentials, or repository write permission. Formal publication is explicitly reserved for the maintainer.

Exit process

After first remote CI passes, Phase 11 receives the required independent second audit. Any findings will be remediated and CI rerun before merge. The manual candidate workflow will be exercised without publishing after the reviewed implementation reaches main.