Publish recovery candidate 3 evidence

[Chris-ObtuseAI]

What changed

• move the permanent download shortcut to v0.3.1-recovery.3
• publish all six tag-bound package hashes and byte counts
• record distribution run 30940450467, exact source commit 41a091d, and verified Sigstore/SLSA provenance
• keep physical owner/laptop pairing and Remote Assist explicitly pending

Verification

• public prerelease has 12 assets
• all three manifests report version 0.3.1 and source commit 41a091dd02232a92238515996fee9387f40223c8
• downloaded Windows installer is 69,125,163 bytes with SHA-256 793cab7cd16e3c40d8ffe7e91e48729548c8f0b40fe124bf73c4ff0591ccf115
• gh attestation verify binds all 12 subjects to the public repository, tag, workflow, and source commit
• git diff --check passes