CI: release-gated verify-tarball job (install packed tgz into fresh app, build iOS + Android)

Problem

Static checks (publint, attw, tarball-contents — see companion issue) confirm the package shape, but not that the published tarball actually builds and runs in a consumer project. For a native module shipping prebuilt .so/xcframework binaries, the only real proof is installing the packed tarball into a clean app and building it for both platforms.

Proposed: release-gated verify-tarball job

Run on release (or nightly), not every PR, since it's minutes-scale on macOS + Ubuntu:

• Pack the module (npm pack, or publish to a throwaway Verdaccio local registry to also exercise @comapeo/ipc dependency resolution).
• npm install the .tgz into a minimal fresh app (not apps/example, which aliases the workspace) — or temporarily drop the Metro alias.
• Run npx expo prebuild + a release-mode native build on:
  • macOS → iOS (xcodebuild, verifies the xcframeworks embed + codesign from the published tree).
  • Ubuntu → Android (gradlew assembleRelease, verifies jniLibs + nodejs-project assets from the published tree).

Notes

• Verdaccio gives a hermetic publish→install loop without touching real npm and without OIDC.
• The existing iOS/Android test workflows are good references for the toolchain setup (Xcode 26.3 select, setup-node, simulator resolution).

Context

Spun off from the release workflow PR (.github/workflows/release.yml). Companion to the fast PR-level package-lint issue.

Start with .github/workflows/release.yml and the existing iOS and Android test workflows to understand their toolchain setup. Define the fresh consumer app and packed-tarball or Verdaccio flow, then verify the release-gated job builds the tarball-installed app for iOS with xcodebuild and Android with gradlew assembleRelease.