fix(snap): build from locked python inputs and verify artifacts (#1041)

* fix(snap): build and verify payload from locked python inputs

* docs(snap): document locked inputs and artifact verification

* test(clipboard): isolate restore workers between tests

* test(packaging): tighten isolation and clarify snap audit guarantees

* fix(ci): run snap recipe tests on snap-only changes

A change to snap/snapcraft.yaml or snap/local/smoke-test.sh only matched
the snap filter, so the Python tests that guard the recipe (including the
portable whisper.cpp flags from #957) and the smoke script were skipped.
Match all of snap/ in the python filter, as scripts/ already is.

* docs(snap): use a version placeholder in the smoke-test example

---------

Co-authored-by: Jatin <jatinkrmalik@gmail.com>

docs/RELEASE_PROCESS.md

@@ -451,7 +451,9 @@ After pushing the tag, the GitHub Actions workflow will automatically:
    `FLATPAK_GPG_PRIVATE_KEY` + `FLATPAK_REPO_TOKEN` are configured — see
    docs/FLATPAK_REMOTE.md)
 8. Deploy the website to vocalinux.com
-9. Build the amd64 snap, attach it to the GitHub Release, and try Snap Store
+9. Build the amd64 snap from locked Python exports and run the installed-artifact
+   gate described in [SNAP.md](SNAP.md), then attach it to the GitHub Release and
+   try Snap Store
    `edge`/`candidate`. Store human review (for example a super-privileged
    `allow-installation` plug) must not block the GitHub `.snap`. `stable` does not auto-release (#783):
    after candidate QA, dispatch `snap-promote.yml`, which releases the