[verification] HIGH: Witness verification reports missing artifacts for all 3 platforms

## Summary

The witness signature verification script (`verify.mjs`) reports that every manifest entry is missing for all three platforms (macOS, Linux, Windows). The script exits 0 but cannot perform any Ed25519 signature validation because the checkout is source-only and the referenced `dist/` artifacts do not exist.

## Impact

Build integrity assurance is non-functional in the verification environment. No signatures can be checked for the current commit, making it impossible to confirm artifact authenticity for any platform.

## Expected

Running the following commands should each report:
```
Ed25519 signature valid: yes
pass=N
drift=0
regressed=0
missing=0
```

Commands:
```
node plugins/ruflo-core/scripts/witness/verify.mjs --manifest verification/macos/manifest.md.json
node plugins/ruflo-core/scripts/witness/verify.mjs --manifest verification/linux/manifest.md.json
node plugins/ruflo-core/scripts/witness/verify.mjs --manifest verification/windows/manifest.md.json
```

## Actual

All three commands exit 0 but output:
```
verify.mjs: every manifest entry is missing and the manifest references
dist/ artifacts. The checkout appears to be source-only (no build run).

Fix: from the repo root, run `npm ci && npm run build` (or the
equivalent for the workspaces witness markers reference) before
invoking this script. See #1880 for the full diagnosis.
```

## Command Output

```
=== macOS ===
verify.mjs: every manifest entry is missing and the manifest references
dist/ artifacts. The checkout appears to be source-only (no build run).
EXIT: 0

=== Linux ===
verify.mjs: every manifest entry is missing and the manifest references
dist/ artifacts. The checkout appears to be source-only (no build run).
EXIT: 0

=== Windows ===
verify.mjs: every manifest entry is missing and the manifest references
dist/ artifacts. The checkout appears to be source-only (no build run).
EXIT: 0
```

## Recommended Fix

Run `npm ci && npm run build` (or the workspace equivalent) before invoking `verify.mjs`. Consider integrating witness verification as a post-build CI step rather than against a raw source checkout. See referenced issue #1880.

## Relevant Report Section

Check 1 — Witness Signature Verification: FAIL / SEVERITY:HIGH

## Commit SHA

`791d24b36f2621aebe2d1a4d8cc5008561aa27b4`

## Timestamp UTC

`2026-07-31T07:02:47Z`

Start with plugins/ruflo-core/scripts/witness/verify.mjs and the verification/macos/manifest.md.json, verification/linux/manifest.md.json, and verification/windows/manifest.md.json manifests. Run npm ci && npm run build from the repository root, then rerun all three commands; done means each reports valid Ed25519 signatures with missing=0, and the verification path is suitable for built artifacts.

Written by the indexing model from the issue text.