fix(release): close two publish-path verification gaps (§B hardening)

- create-release.sh: assert the freshly built frontend dist actually embeds
  the bumped version before packaging — the ui-dist-version guard in
  tests/release/run.sh is behind --with-build, which the release path never
  passes, so a silently no-opped npm build could ship a stale dist with a
  valid sha256. Verified against the real dist (passes on current version,
  trips on a missing one).
- publish-release-assets.sh: verify published assets by downloading and
  comparing sha256 against the manifest, not just Content-Length — a
  size-correct/content-wrong mirror asset now fails the publish gate.
  Verified live against the v1.7.99-alpha assets on the vps2 mirror.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/create-release.sh

@@ -158,6 +158,15 @@ cd "$PROJECT_ROOT/neode-ui"
 npm run build 2>&1 | tail -3
 cd "$PROJECT_ROOT"
 
+# npm run build can silently no-op (vue-tsc EACCES burned us before) — a stale
+# dist would ship with a perfectly valid sha256. Require the freshly built
+# bundle to embed the version we just bumped to before it gets packaged.
+if ! grep -rqo "${VERSION}" "$PROJECT_ROOT"/web/dist/neode-ui/assets/*.js; then
+    echo "Error: web/dist/neode-ui does not contain v${VERSION} — the frontend" >&2
+    echo "       build no-opped or its output is stale. Aborting release." >&2
+    exit 1
+fi
+
 echo "[5/8] Validating curated changelog..."
 
 CHANGELOG_FILE="$PROJECT_ROOT/CHANGELOG.md"