Validate release artifacts on Linux and macOS

[keemgdeok]

Summary

• build each release JAR once and pass the exact artifact between jobs
• verify its checksum and doctor --demo guard on Ubuntu and macOS with Java 17 before publishing
• restrict release write permission to the publish job
• prepend the required limited-external-validation disclosure to v0.1.0 release notes
• move external-user and remote request/transfer evidence to post-0.1.0 roadmap work

Verification

• Java 17 clean build, Spotless, and 38 automated tests
• actionlint 1.7.7
• public v0.1.0-rc.1 JAR and checksum on Linux Temurin 17.0.20
• the same public JAR and checksum on macOS arm64 Temurin 17.0.20.1
• MinIO + Iceberg REST E2E: Spark count 4, doctor guard passed, all four rules passed

This PR does not create the stable tag or release.