ci: rebuild release pipeline around OSS manifest protocol

Replace the broken yarn/Node 18 release workflow (wrong package manager,
missing build/ dir, archived actions) with a manifest-based distribution
flow modeled on yaklang/browser-binaries-mirror:

- scripts/package-release.mjs: package the four variants, emit
  release-entry.json and per-artifact sha256 checksums
- scripts/build-manifest.mjs: merge into a bounded public manifest
  (10 versions) with invariant validation
- scripts/publish-oss.mjs: immutable artifacts (forbid-overwrite,
  one-year cache) and mutable manifest (5-minute cache, checksum
  published second), idempotent via head + sha256 comparison
- scripts/verify-public.mjs: post-publish verification from the public
  endpoint (bytes, headers, zip layout)
- release.yml: pnpm + Node 22, full verify:production, OSS publish,
  GitHub Release, separate public verify job, publish concurrency group
- ci.yml: run verify:production on push/PR
- single-source the extension version in package.json (wxt.config reads)
- document the distribution protocol in README

package.json

@@ -4,6 +4,7 @@
   "private": true,
   "version": "0.2.0",
   "type": "module",
+  "packageManager": "[email protected]",
   "scripts": {
     "dev": "wxt",
     "dev:wsl": "node scripts/dev-wsl.mjs",
@@ -49,10 +50,13 @@
   },
   "devDependencies": {
     "@types/jsrsasign": "10.5.15",
+    "@types/node": "^22.0.0",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
     "@types/ws": "^8.18.1",
     "@wxt-dev/module-react": "^1.2.2",
+    "adm-zip": "^0.5.16",
+    "ali-oss": "^6.21.0",
     "jose": "6.2.3",
     "jsencrypt": "3.5.4",
     "jsrsasign": "11.1.3",