Add Aqua registry verification

[konojunya]

Summary

• add an owner-maintained Aqua registry mapping for the four supported GitHub Release archives
• require generated SHA-256 locks and verify the release workflow Sigstore identity
• exercise all OS/architecture mappings with Aqua 2.62.3 and run a native install lifecycle in CI
• document the immutable registry update procedure

This prepares the registry contract without advertising the Aqua channel as available. A follow-up change will pin this merged registry commit in user-facing configuration and activate the channel after a clean remote install.

Verification

• aqua update-checksum
• aqua update
• Aqua 2.56.1 and 2.62.3 install --test for darwin/amd64, darwin/arm64, linux/amd64, and linux/arm64
• native macOS arm64 install with stack --version, init, check, and render
• node scripts/validate-distribution-contract.mjs
• node --test scripts/distribution-contract.test.mjs
• cargo fmt --check
• cargo test --locked
• git diff --check