Fix release version stamping

[nicodes]

Summary

• pass the complete computed vX.Y.Z tag into the release Build action
• remove the undeclared Test input and tighten the Build version contract
• fail closed before attestation/publication unless the Linux x86_64 archive contains one regular root binary whose version stdout is byte-for-byte termcade vX.Y.Z

Fixes https://github.com/aviorstudio/termcade-be/issues/109

Risk

Risk: high — this changes the supply-chain release artifact stamping and the pre-publication release gate.

Team No Review: explicitly selected; reviewer requests, review comments, approving verdicts, and approval gates are skipped.

Verification

• Go 1.26.2; source a15584c777384550ee6ce3e600c453a642acc1c5
• actionlint .github/workflows/*.yml; shellcheck and bash -n on the gate
• canonical formatting, both vets, race suite with -count=1 -timeout 10m, consumer build/vet
• all five release targets built with -trimpath -ldflags "-s -w -X main.version=v0.0.10"; checksums verified
• Linux amd64 archive gate uses a private mktemp -d, exact one-entry/root/regular-file validation, non-symlink extraction, a 30-second execution timeout, and byte comparison including the trailing newline
• deliberate failure under GOOS=linux/GOARCH=amd64 omitted only -X main.version=v0.0.10: expected termcade v0.0.10, actual termcade v0.0.10-0.20260827192328-a15584c77738, exit 1; rebuilt with the stamp and the identical gate exited 0

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}