ci(release): run package release canaries

[drew]

Summary

Reworks the release canary workflow to validate published release artifacts directly. The workflow now resolves the release tag once, downloads Debian, RPM, and Homebrew assets from the GitHub release, installs them in package-native environments, and verifies that a sandbox can run a hello-world command.

Related Issue

N/A

Changes

• Resolve the release tag in a shared job for manual, dev, and tagged release triggers
• Replace install-script checks with direct Debian and RPM package installs on amd64/arm64 Linux runners
• Add a Homebrew package canary on macOS using a local tap from the release formula
• Capture container, Podman, gateway, Homebrew service, and VM console logs when canary sandbox creation fails

Testing

• mise run pre-commit passes
• Unit tests added/updated (not applicable: workflow-only change)
• E2E tests added/updated (not applicable: CI workflow change)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable)