Fix hosted SSH trust and release publication

[kb2vhn]

Purpose

Correct the defects discovered by the first real consuming-project hosted
adoption attempt against ISRAS 0.1.2.

Changes

• Establish SSH commit-signer trust from the exact pinned Engineering Standards
  source before hosted repository validation.
• Digest-bind and inventory the allowed-signers trust material.
• Reject missing, altered, wrong-key, and wrong-principal trust.
• Retain both .local/isras and .local/validation evidence.
• Use uploads.github.com for GitHub Release asset-byte uploads.
• Add regression tests and synchronize standards and adoption documentation.

Boundaries

This pull request does not:

• modify a consuming project;
• rewrite or replace isras-v0.1.2;
• create a release or tag;
• move main;
• claim that ISRAS 0.1.3 is accepted or published.