Harden release integrity and refresh security dependencies

[aleff-github]

Summary

• update Jackson runtime dependencies from 2.22.2 to 2.22.3;
• move actions/setup-java to the already-tested v6.0.1 immutable commit;
• verify the distributable JAR in CI and emit a SHA-256 file;
• add a tag-driven release workflow that builds, verifies, checksums, and publishes the same artifact;
• document the historical v0.3.3 validation-build/release-asset digest mismatch;
• refresh BApp Store readiness against PortSwigger's acceptance criteria updated 2026-09-22.

Security rationale

Jackson Databind 2.22.3 includes fixes for CVE-2026-91776 and CVE-2026-91777. The release workflow also prevents a repeat of the current v0.3.3 provenance mismatch by refusing version/tag divergence and by generating the checksum from the exact JAR that is staged for publication.

Release safety

The release workflow refuses to publish when:

• the tag and Gradle project version differ;
• the build produces anything other than one WorkflowGuard JAR;
• Montoya API classes are bundled;
• duplicate JAR entries exist;
• release notes are missing;
• a GitHub release for the tag already exists.

No product behavior or target-request semantics are changed by this PR.