fix(registryctl): bind generated projects to release image lock

[jeremi]

Summary

• replace registryctl's embedded Relay and Notary digests with a strict, versioned release image lock
• render the lock from exact tag-built image digest evidence and carry it through checksums, file SBOM, capsule, cosign, SLSA provenance, upload, and reconciliation
• install the lock atomically beside registryctl for v0.9.0+ while preserving truthful binary-only v0.8.4 behavior
• fail init and add before mutation when the matching lock is missing or invalid; existing project runtime commands remain lock-independent
• document v0.8.4's immutable digest workaround and the v0.9.0+ verification/migration path

Release safety

• the current release workflow rejects lock-bearing releases below v0.9.0 before builds or image pushes
• the built registryctl version is verified before artifact upload and rechecked before lock rendering
• lock JSON denies unknown fields and binds the release tag, manifest source ref, tag target, linux/amd64 platform, and exact GHCR repositories/digests
• the installer validates both checksums, moves the lock first and binary last, and restores the prior pair on failure or termination
• no mutable tag or live registry lookup is used for project generation

Verification

• cargo test -p registryctl --locked (104 tests)
• cargo clippy -p registryctl --all-targets --locked -- -D warnings
• python3 -m unittest release/scripts/test_registry_release.py (42 tests)
• actionlint .github/workflows/release.yml
• bash -n and shellcheck for the installer and tutorial gate
• docs content, Markdown, style, and build checks
• full Docker-backed npm run check:tutorial:registryctl for Relay and Notary
• independent release-contract and integration reviews

Refs #278. Do not close #278 until the v0.9.0 published binary and image lock pass the fresh-reader release proof.

Hosted/public first-run publication remains held pending #198 and #330; this PR does not lift that hold.