Add release qualification workflow and feature scenarios

[aidangarske]

Release preparation currently depends on separate manual commands, and the optional HPKE, HSS/LMS, ML-DSA, and PSA/EAT paths do not share one release-only qualification gate.

This adds a ci:release/manual Release Qualification workflow that validates version metadata, runs the normal release commands plus advanced feature scenarios, compiles the public API as C++, runs Valgrind, merges coverage profiles, audits the normal CI runs, and builds reproducible smoke-tested source archives. It also strengthens the HPKE, stateful HSS/LMS, and PSA/EAT scenarios with state-advance and tamper-rejection checks, and expands the nightly workflow sweep.

The internal release procedure remains outside the public repository. docs/Testing.md documents only the public test targets and their coverage.

Validation:

• make clean && make test
• make cxx-check
• shellcheck and POSIX syntax checks for all release scripts
• workflow YAML parse
• house-style and empty-brace scans
• make release-validate VERSION=1.0.0 RELEASE_REF=v1.0.0
• reproducibility comparison across two independently generated 1.0.0 tar/zip sets
• independent tar and zip build/test/tool/demo smoke tests

Release artifact output follows the v1.0.0 naming convention:

• wolfcose-X.Y.Z.tar.gz
• wolfcose-X.Y.Z.zip
• wolfcose-X.Y.Z.sha256

Detached .asc signatures are intentionally left to the release signer after
the final artifacts are approved.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.