Verify clean installations across all distribution channels

[konojunya]

Summary

• Add a read-only 19-cell native installation matrix for Direct, Aqua, Cargo (MSRV and stable), and Homebrew.
• Exercise published command metadata, configuration, templates, JSON/SVG output, and an explicit audited provider import with attribution in disposable stores.
• Bind native binaries to verified release archive bytes and registry installs to the exact packaged source commit; compare generated assets with the published source rather than unreleased code.
• Fail the aggregate on failed, skipped, cancelled, missing, or mismatched evidence. Keep full activation distinct from native/Cargo scopes and immutable publication metadata.

Validation

• 20 Node guard tests and 15 Python tests passed locally, including negative cases.
• actionlint and whitespace checks passed.
• Published macOS arm64 CLI 0.5.1 passed the full command/import/render smoke (62 icons).
• Downloaded archive checksum, source-bound provenance, and exact package verification passed locally.
• The pull request runs the actual 19-cell installation matrix. Publication workflow integration follows as a separate change.