feat: verify offline integrity of synthetic release capsules

[rudycelekli]

Description

A downloadable synthetic package needs reproducible provenance and integrity evidence without claiming regeneration from a checksum. This adds canonical release capsules for configuration, artifact commitments, license declarations and privacy/utility check outcomes.

Closes #2854.

Type of Change

• New feature
• Documentation update
• Test addition/improvement

Changes Made

• Pin generator configuration, versions, seed commitments, provenance, optional external model digests and per-asset license declarations.
• Verify supplied artifact bytes, canonical manifest commitments and exact asset membership offline.
• Retain failed/not-evaluated checks and explicitly separate integrity verification from generation reproduction.
• Update API documentation, navigation/publication classification and CHANGELOG.md.

Testing

• Focused acceptance and negative controls: 11 passed Python3.12.11.
• Full candidate suite: 29566 passed, 186 skipped, 24 warnings in 779.37s (0:12:59). Command: PYTHONPATH="$PWD" .venv/bin/python -m pytest tests/ -q, using the frozen Python 3.12 environment and candidate-local imports.
• make format, make lint, make format-check and make type-check passed.
• Staged Gitleaks 8.30.1 passed.

Documentation and Dependencies

• Updated documentation, API docstrings and CHANGELOG.md.
• No new dependencies.

Checklist

• Read repository contribution, conduct and maintainer guidance.
• Reviewed the final source and organized the change as one commit.

Limits

License and check outcomes are caller declarations. Integrity verification never claims that generation was reproduced or that the package is clinically qualified.