fix: harden release packaging verification (#1)

fix: ignore local worktrees in release surface manifest

merge codex/release-proof-remediation

fix: harden release proof and packaging flow

chore: ignore local worktrees

merge remote main into local release

chore: prepare Codex-Sentinel public release

Initial commit