fix(ci): make replacement provenance and LFS trees reproducible

[zoeyrose]

Closes #36

Summary

Make replacement provenance and LFS-backed source-tree validation reproducible
from clean CI checkouts, preserving the existing source ledger and Classic
release gates.

Implementation / behavior

• Validate disconnected replacement predecessors from an immutable,
  commit-bound source archive when the local Git object graph does not contain
  the recorded commit.
• Compare hydrated LFS payloads with their canonical pointer OID and size while
  retaining exact Git tree, mode, index, clean-worktree, and source-stability
  checks for non-LFS files.
• Add focused regression coverage for missing historical objects, malformed or
  mismatched LFS pointers, hydrated payloads, and ordinary Git blobs.
• Keep the existing pinned workflows, deterministic fixture builds, playtest
  tree, Semantic Release, Classic archive, and checksum contracts fail-closed.

Validation

• tools/validate.sh
• python3 -m unittest discover -s tests -v
• python3 -m compileall -q tools tests
• bash -n tools/build-release-assets.sh tools/package-release.sh tools/validate.sh
• git diff --check
• GitHub Actions check and Semantic Release workflows on the final head

Limitations / follow-up

Published release coordinates remain owned by Semantic Release; this change
does not create tags, releases, or Classic runtime consumer updates.

[github-actions]

🎉 This PR is included in version 1.0.0 🎉

The release is available on:

• v1.0.0
• GitHub release

Your semantic-release bot 📦🚀