feat(release): publish base-cli BOM evidence

[codeforester]

Summary

• Generate a deterministic RELEASE-BOM-ROW.json from the reviewed base-cli source revision.
• Validate the row alongside checksums and SPDX metadata.
• Attach the row to release metadata artifacts and GitHub Releases.

Issue

Fixes #334
Parent: basefoundry/base#2115

Validation

• tests/test_package_workflow.py and tests/test_validate_release_ref.py: 5 passed.
• Generated and validated sample release metadata with a full source revision.
• Python compile check and git diff --check.

No tag or release was published.

[codeforester]

Hosted checks are green on 13b26c64. Deterministic BOM-row generation and release attachment are ready for the coordinated train. No tag or release was published.