feat: ship verified Zi Setup distributions

[ss-o]

Zi Setup currently requires a separately supplied engine and has no release artifacts or operation-level progress. This change ships an exact checksum-verified z-shell/src engine snapshot, streams validated apply events, exposes the engine-backed Zi ref and .zshrc choices in the TUI, and adds reproducible release packages for Linux, macOS, and Windows.

The normal command is now zi-setup; --engine remains available for development. Releases build amd64 and arm64 archives, publish sorted SHA256SUMS, run tests plus CodeQL on the exact annotated tag commit, and create GitHub artifact attestations. Windows packages require a POSIX sh on PATH.

The bundled engine is pinned to z-shell/src commit af663e2253e8d6dbdf9a36bd0a9fd374b0215fb7 from z-shell/src#226. Merge that PR after its consumer dependencies, then merge this PR. Related consumer updates:

• docs(zi-install): document setup apply events interface .github#655
• docs(installation): document setup apply events and automation contract wiki#924
• docs(readme): document setup apply events interface zi#569

Validation:

• go mod tidy -diff and go mod verify
• go test -count=1 ./...
• go vet ./...
• go test -race -count=1 ./...
• bundled engine two-phase apply and event integration in a disposable home
• six-target packaging twice with byte-for-byte reproducibility and checksum verification
• actionlint, shellcheck, Bash syntax, gofmt, and git diff --check
• exact bundle comparison against the pinned source commit

Closes #3