safety: gate releases on verified published builds

[Heoooooon]

Summary

• require ci.yml success for the exact tagged commit before release creation proceeds
• keep GitHub Releases as drafts while macOS/Windows artifacts are packaged, signed/notarized, and attested
• publish the Release only after every artifact job succeeds
• make macOS/Linux/Windows bootstrap and detached update paths resolve the latest published GitHub Release, not merely the newest v* tag
• fail closed on the official repo when the published release cannot be resolved
• make Linux existing-checkout fetch/checkout failures fail closed instead of continuing from stale code
• add regression contracts for release gating and published-release bootstrap semantics
• align Korean/English README and VERSIONING policy

Safety model

A pushed tag alone is no longer sufficient to become the default install target. The expected chain is:

tag -> exact-SHA CI success -> draft Release -> platform packaging/signing/attestation -> publish -> eligible for default bootstrap/update

Verification

• static release contract tests extended in tests/release-signing.sh
• the jq status parsing used by the release gate was separately reproduced with jq 1.7 and fixed before opening this PR
• existing PR CI should validate Bash/PowerShell syntax, installer E2E, idempotency, doctor behavior, upgrade paths, and the release contract