[sanskarIN]

Goal

Let the repository owner publish v1.4.0 directly in GitHub's UI without manually uploading a ~1.55 GB set of files. GitHub Actions must not create or publish the tag/release; it only attaches already-verified assets to a release the owner has published.

Changes

• Introduce Attach verified release assets on release: published for non-prerelease owner-published releases.
• Block attachment unless tag exactly equals current main SHA and CMake version matches, and an unexpired, successful Prepare manual release artifact exists at that exact SHA.
• Download manual-release-assets from that preparation run only; re-hash all four payloads, inspect ZIP/TAR and SPDX with the newly merged release asset validator (feat(release): add independent manual-release asset integrity gate #146), upload exactly five named assets, and independently verify GitHub asset names and lengths.
• Refuse preexisting assets to prevent accidental mixing or overwrite of packages.
• Build/update GitHub Pages only after successful attachment; avoids publishing an empty download page on the release event.
• Regenerate fresh release artifacts whenever the uploader workflow changes, and document quality gates, owner publication, and partial-upload recovery.

Acceptance / release safety

• The owner must still complete physical Windows audio/video/editing/project QA and review release notes before publishing.
• main changes on integration, so do not reuse the old v1.4.0 asset bundle from eb64133. Wait for CI, Windows clean-host checks, website, and Prepare manual release to pass on the new integrated commit; test the new attachment job when the owner publishes.
• An owner-published release is immediately visible; if the upload fails it remains visible but incomplete. Inspect the workflow before announcements.

No stable GitHub Release is created by this PR.