release download: add --verify to check immutability and build provenance before downloading - #14783

…; gate scripts and root shadows are the grader (PR #718 re-attack, W6-01)

The re-attacker greened every build context without touching a workflow:
a one-file shard-tests.py that ran nothing (and wrote one padded coverage
file), `sys.exit(0)` in bench/vf-bench/gate.py, a run.sh that printed the
pinned transcript, or a top-level `pip/` or `coverage/` package that ran
instead of the locked tool. CI that runs PR code can always be forged by
that code, so the real control for a PR the owner did not write is a trusted
GO at the exact head. This makes the gate's own part of that airtight and
narrows the cheap channels:

a. The owner exemption also needs the PR's head repository to be this
   repository: an owner-opened PR whose head is a fork's branch is refused
   like any other, since the fork keeps push access to it.
b. The changed paths are read for the exact head SHA the status is posted
   on: compare/<base branch>...<head sha> (the base branch's live tip, so a
   branch updated from main is not charged main's changes; base.sha only
   when the ref is missing or unsafe), never the SHA-less PR files list, so
   a head flipped M -> benign -> M across the gate's reads no longer
   passes. The re-read of the PR still refuses a head that moved. A base
   that cannot be named, or a list at the API's 300-file cap or shorter
   than changed_files, fails closed. Compare needs Contents: read, which the
   verdict-gate app does not hold, so verdict-gate.yml now reads with the
   job's own GITHUB_TOKEN (contents: read) and passes the app token as
   GH_STATUS_TOKEN, used only to post the status. No app permission
   change is needed.
c. The grader also covers GATE_SCRIPTS, the 14 scripts the required jobs
   (gates and its needs, pinned-demo) name on a run: line; a test parses the
   workflows and holds the list to them both ways. guard runs the base
   branch's floor_guard.py, so nothing of the PR's is listed for it. It also
   covers a root module file (.py, .pyc, .pyd, .so, .pth) and any top-level
   directory not in TOP_LEVEL_DIRS (a test holds that set to `git ls-tree`),
   which a job running `-m coverage` / `-m unittest` from the root would
   import.
e. The module docstring, both verdict workflows' headers and
   docs/ops.md#merge-gate say it plainly: CI runs the PR's code; for a PR
   the owner did not open from this repository, the merge control is the
   trusted GO at the exact head, the reviewer's attestation that they read
   the diff, which no check can verify. The ops page's "re-opens it from
   their own branch" now reads "from a branch of this repository".

(d, `python3 -I` in the workflows, follows in its own commit.)

Red tests: tests/test_verdict_check.py APrCannotChangeItsOwnGrader
test_the_grader_read_is_bound_to_the_exact_head,
test_an_owner_pr_from_a_fork_branch_gets_no_exemption,
test_the_gate_scripts_are_the_grader_too,
test_a_new_top_level_module_is_the_grader_too,
test_the_top_level_list_is_this_repositorys,
test_the_gate_scripts_list_holds_what_the_required_jobs_run,
test_reads_use_the_jobs_token_and_the_status_the_apps (13 failures and 3
errors on the previous checker). My earlier fixtures in this class and in
AForkAuthorCannotGoTheirOwnPr gain the base and head repos a real PR has.
Compare by SHA was checked read-only against a public fork PR
(cli/cli#14783): it resolves the fork head in the base repository and lists
the same files as the PR.