feat(ci): verify the published release, not just the workflow (#791)

* feat(ci): verify the published release, not just the workflow

* fix(ci): filter attestations by predicate, name a missing distribution

Two findings from review on #791.

The attestations query accepted any predicate, so an SBOM would have read as
build provenance while `gh attestation verify`, the command the notes hand
users, rejected the artifact. It now sends the same
`predicate_type=https://slsa.dev/provenance/v1`. Checked on a real digest: the
SLSA filter returns the bundle, a foreign predicate returns 404.

check_pypi compared whatever distributions were left, so a release that lost its
sdist passed on the wheel alone. Each expected suffix is now named when absent.
The lazy urllib import moved past the early return, where it belonged.

The other two findings do not hold. `workflow_run.head_branch` carries the tag
for a tag-triggered run: the last four release runs report v0.16.2, v0.16.1,
v0.16.0 and v0.15.0. And `host_env()` is for the app spawning host binaries out
of an AppImage; `scripts/` is in no `packages` entry and the AppImage build
never references it, so this cannot run from a bundle.

* fix(ci): read release digests from the REST API

gh release view --json assets omits digest on gh 2.46, which is what
many distros ship and what just verify-release often runs, so every
asset failed as undigested. Pull the release through gh api instead,
treat a null body as notes FAIL, and prefer removeprefix for the tag.

* fix(ci): fail verify when PyPI has an extra distribution

Matching release digests alone left a differently named wheel or
sdist on PyPI unchecked. Reject those extras too, same suffixes.

* fix(test): clear tempfile mock before urllib import

Other suites leave a MagicMock in sys.modules['tempfile'], which
breaks urllib.request import with a metaclass conflict in the extra
PyPI distribution check. Drop the stub (and stale urllib modules)
first, and assert the full problem list.

* fix(ci): restore real tempfile before urllib in verify test

The MagicMock tempfile left by recognition_manager still broke
urllib.error on CI. Put the real module back and drop cached urllib
packages before the import.

---------

Co-authored-by: Jatin K Malik <jatinkrmalik@gmail.com>

docs/RELEASE_PROCESS.md

@@ -79,8 +79,16 @@ Install `just` from https://just.systems or the distro package `just`.
 - [ ] Push branch and create PR
 - [ ] After PR merge, create tag: `git tag -a vX.Y.Z-PHASE -m "Release X.Y.Z-PHASE"`
 - [ ] Push tag: `git push origin vX.Y.Z-PHASE`
+
+### After the release run finishes
+- [ ] Run `just verify-release` - the published release verifies as published
+- [ ] Re-run it after any hand edit to the release: attaching an asset, or rewriting the notes
 ```
 
+`verify-release.yml` runs the same check when the release workflow finishes.
+It cannot see a hand edit made afterwards, which is how every v0.16.2 defect
+arrived, so run it yourself after touching a published release.
+
 ## Detailed Release Steps
 
 ### Step 1: Determine Version Number
@@ -158,7 +166,12 @@ Use these rules for every GitHub Release body (and for the draft pasted into the
 6. Optional: `## Improvements`, `## Docs`, `## Packaging`
 7. `## Thanks` — external PR authors and issue reporters by `@handle`
 8. `## Install / Upgrade` — `install.sh`, AUR, PyPI, **AppImage**, Flatpak status (honest)
-9. Footer compare link: `https://github.com/VocaHQ/vocalinux/compare/vPREV...vX.Y.Z`
+9. `### Verifying what you downloaded` (required, and easy to lose). `release.yml`
+   generates it, with `sha256sum -c --ignore-missing SHA256SUMS` and
+   `gh attestation verify`. A hand-written body replaces the generated one, so carry
+   this block over deliberately. v0.16.2 published a checksum manifest and build
+   provenance and mentioned neither, so nothing a user reads told them either existed
+10. Footer compare link: `https://github.com/VocaHQ/vocalinux/compare/vPREV...vX.Y.Z`
 
 #### Include / exclude