fix: require clean release manifests

[JNHFlow21]

Summary

• keep the performance gate's generated receipt outside the source checkout
• require the release tree to remain clean after all gates
• reject any distribution manifest that reports source_dirty=true
• add regression coverage for both boundaries

Context

The v1.0.0 workflow successfully built and verified the release, but the performance gate wrote a generated benchmark file inside the checkout before packaging. The published v1.0.0 assets were rebuilt from a clean tag checkout and replaced; this prevents recurrence.

Verification

• benchmark contract tests passed
• dirty-manifest rejection test passed
• performance gate passed without changing Git status
• TROVE privacy scan passed