harden shim artifact validation

[mcuadros]

Summary

Hardens the optional native shim distribution path so a release artifact is
verified before publication and rejected deterministically when it does not
match the Go loader.

• Add a generated C/Go contract identifier and require it at load time.
• Require all non-conditional shim exports before publishing any function
  pointers; libavdevice remains an explicit optional capability.
• Add ffshim-manifest, which loads the exact final artifact, exercises safe
  helpers, and records its platform, FFmpeg family, contract, and SHA-256.
• Build release shims into versioned FFmpeg-family directories and verify their
  manifests again in the packaging job.
• Remove the unversioned, stale prebuilt binaries from the source tree; release
  artifacts are now the only distribution channel for prebuilt shims.

Root cause

The repository's prebuilt shims could outlive changes to the C shim and the Go
loader. The previous workflow copied and uploaded them without loading the final
artifact or recording which FFmpeg family it belonged to.

Impact

Consumers fail closed with a diagnostic for an old, partial, tampered, or
wrong-family shim instead of reaching an incompatible native entry point.
Release archives identify the exact compatible artifact by platform and FFmpeg
major.

Validation

• go test -count=1 ./... with local FFmpeg 9.0.1
• go test -short -count=1 ./...
• go vet ./...
• go test -race -count=1 ./internal/shim ./cmd/ffshim-manifest
• Cross-compilation of shim components for Windows amd64/arm64, macOS
  amd64/arm64, and Linux arm64
• actionlint .github/workflows/ci.yml .github/workflows/build-shim.yml
• Podman-isolated build/load verification against FFmpeg 6, 7, 8, and 9
• Negative Podman test: the legacy Linux prebuilt shim is rejected before use