build: harden release artifact licensing

[XiaoHongbo-Hope]

Summary

• Commit Cargo.lock, use locked builds, and pin release tooling.
• Generate reproducible dependency inventories and target-specific third-party license reports.
• Package and byte-verify LICENSE, NOTICE, and third-party reports in Rust crates, Python archives, and Go release assets.
• Verify Linux wheel OpenSSL libraries, native formats, architectures, versions, and legal metadata.
• Harden Rust publishing with MSRV checks, package-content checks, tag/version validation, ordered publishing, and safe reruns.

Background

This applies the release-vote fixes from apache/paimon-full-text#17 and apache/paimon-full-text#22. Paimon Rust had the same artifact-exact legal metadata and Windows line-ending risks, plus several repository-specific gaps:

• Cargo.lock was ignored.
• Published Rust crates omitted test helpers and fixtures needed by packaged tests.
• Go native assets had no matching legal sidecars.
• Linux wheels bundled OpenSSL 1.1 shared libraries without explicit license coverage.

Verification

• cargo deny --locked --all-features check licenses
• python3.11 scripts/dependencies.py verify
• python3.11 scripts/release_licenses.py --check
• rustup run 1.91.0 cargo check --locked --workspace --all-targets --all-features
• cargo publish --locked -p paimon -p paimon-datafusion --all-features --dry-run
• Rust crate package inventory checks
• Python five-wheel and sdist verifier tests, including OpenSSL negative cases
• Go native artifact positive and negative verifier tests
• cargo fmt, Ruff, Python byte compilation, YAML parsing, and actionlint

[XiaoHongbo-Hope]

This mixed PR has been split into:

• build(python): give RC artifacts unique versions #557: unique Python RC artifact versions
• build: lock and verify release dependencies #558: locked release dependency foundation
• build(bindings): package complete legal metadata #561: Python/Go binary legal metadata

The Rust multi-package dry-run failure was not reproduced: Cargo 1.91 and 1.93 validate both crates through a temporary registry, while the real publish path already uploads paimon before paimon-datafusion.

[XiaoHongbo-Hope]

Rust crate packaging and ordered publishing are now isolated in #562.