Releases: prebuilt artifacts, checksums, signatures, SBOM, reproducible builds #146

Part of ComlineProject/core#227. Proposal: ComlineProject/docs#163, proposals/offline/supply.md#tooling-into-the-gap.

Today the only install path is cargo install --path .. For sealed networks:

• prebuilt binaries per platform, with checksums and signatures;
• reproducible builds: rebuild from source and compare bytes, as comline-typescript does for its wasm core;
• an SBOM per release.

Related: #1 (publish to crates.io). Open: the signing scheme (sigstore, minisign) and the SBOM format (SPDX, CycloneDX).