Check CLI release reproducibility

[ocularminds]

Context

CLI releases produce checksummed archives for four OS/architecture pairs. The pipeline does not yet compare repeated builds of the same source and toolchain.

Scope

Add a reproducibility check for release binaries and archives before creating the GitHub release.

Acceptance criteria

• Two clean builds of each target produce identical binaries.
• Archive creation uses normalized metadata so repeated archives are byte-for-byte identical.
• Checksums are compared before release creation.
• The Go version and build flags are recorded with the release evidence.
• A mismatch blocks release creation and identifies the affected target.