Harden Actions and build verified release packages

[TonyNa-code]

What changed

• Upgrade all external Actions to current Node.js 24 releases and pin them to immutable commit SHAs.
• Add a reusable, path-bounded Windows packager that builds both Full and Slim archives.
• Download the pinned LGPL FFmpeg archive, verify its archive hash and every bundled binary hash, then validate required encoders before packaging.
• Include project, .NET and FFmpeg license/notices plus internal and external SHA-256 manifests.
• Make Windows and macOS release workflows manually runnable before a tag is created.
• Add .NET notices and a validated version parameter to macOS packages.

Why

The first public build passed but warned about deprecated Node.js 20 actions. The original Windows release workflow also produced only a Slim archive despite the README promising a zero-configuration Full package with FFmpeg.

Impact

Release behavior now matches the documentation: Windows users can choose a smaller package or a complete offline package, while maintainers can validate packages on GitHub runners before publishing a tag. Workflow dependencies are reproducible and no longer emit the Node.js 20 warning.

Validation

• Initial and updated Windows/macOS CI: passed.
• Verified every selected Action declares node24.
• Local Windows Full package: 23 files, 158,346,962 bytes.
• Local Windows Slim package: 12 files, 96,610,886 bytes.
• Packaged GUI CLI mode, CLI and bundled FFmpeg smoke tests: passed.
• ZIP sidecars and every internal SHA256SUMS.txt entry: passed.
• Full package contains pinned FFmpeg and license provenance; Slim package contains no FFmpeg.
• git diff --check and PowerShell parser checks: passed.