Publish reproducible build receipts for verified templates

[OthmaneBlial]

Context

Template cards state the RustFrame version and verification date, but they do not yet link to a machine-readable build receipt. The fixed verification profiles should emit evidence that can be reviewed without trusting the card copy.

Affected area

• scripts/verify_templates.sh
• scripts/validate_template_registry.mjs
• site/showcase.json and showcase cards
• a new versioned receipt schema under schemas/templates/

Acceptance criteria

• Define an additive receipt schema with template ID, source commit, RustFrame version, profile, host, frontend output hash, validation result, and timestamp.
• Fixed profiles emit receipts without reading commands from catalog metadata.
• The generator rejects missing or stale receipts for entries marked verified.
• Showcase cards link to the public JSON receipt.
• Tests detect a changed source commit, version, or output hash.

Test command

./scripts/verify_templates.sh
node --test scripts/validate_template_registry.test.mjs
node scripts/check_site.mjs

Non-goals

• Code signing or notarization.
• Claiming that one host receipt proves native packaging on every operating system.
• Executing arbitrary submission commands.