recovery: restore exact v1.6.38 golden runtime artifact

[masarray]

Purpose

Recover the current stable v1.6.38 release to the exact retained field-verified runtime artifact without rewriting tag history or merging runtime source changes.

Fail-closed authority

• Actions artifact: 10549589733
• Artifact name: ARSAS-r7-scl-interoperability-win-x64
• ZIP SHA-256: d68b9e89487cfd71bf92ac181e5abed35106ea65776a6005eaa863eb6cdc0068
• Portable EXE SHA-256: 555c3d91dbda85cb1b3de453266b33dd26a95cd06fe6805ccb973ed62d19487a
• Runtime app commit: eb8eb13
• Runtime engine commit: 9935d6902d786cc69b299260fe36b835944d5e81

Behavior

On merge to main, the recovery workflow:

1. snapshots the existing v1.6.38 release and assets;
2. downloads the exact retained Actions artifact;
3. verifies ZIP, executable, manifest and commit fingerprints before mutation;
4. removes stale installer / SBOM / provenance assets that describe the wrong runtime;
5. uploads only the exact golden portable binary plus fresh checksum and recovery provenance;
6. downloads the public asset again and re-verifies its SHA-256;
7. preserves an audit bundle as a workflow artifact.

This PR does not merge #333 or engine #137, does not rewrite the tag, and does not modify application runtime source.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.