Parameterized release workflow validation

The original 474083ea74d0df069275da613e62a985d6960056 defaults, staged release bytes, published manifest and public objects are unchanged. No public write or deployment operation was run while adding release selectors.

Added full commit/metadata-directory validation, committed metadata consistency checks, and historical cryptographic re-verification for non-default releases. The verifier binds actual signed Nitro PCR0/PCR1/PCR2, nonce/timestamp, TLS SPKI, hardware policy and software source version to the selected build. Preparation does not accept a displayed verified flag as proof. The generic README derives its state, parameters and hash comparison from the selected evidence, avoiding the original release's hardcoded claims about absent newer patches.

Existing secret/path/blob scans and one-commit shallow checkout checks remain in place. Conditional writes, version IDs and anonymous full-byte readback remain in the publisher. An additional existing-manifest preflight rejects conflicting metadata for an already published source commit before any PUT.

Six local tests passed: original release byte preservation against published hash evidence; strict selectors; old measurements rejected for new source; missing proof rejected before cloud operations; actual old production Nitro evidence verification with nonce/policy/document/source/PCR substitution failures; and a complete isolated local archive/README/manifest preparation using a later metadata commit that preserves the original real proof. This last case exercises the non-default path without pretending the old proof belongs to a10323d.

Actual new-build metadata is expected under measurements/graviton5-production-a10323d-20260909; its evidence commit must be provided explicitly after the new Nitro build/proof is complete. No new-source publication has been performed by this work.