Fix release archive verification false-positive on changelog version headings

[Copilot]

Summary

build-verified-source failed in release run 35318392855 because scripts/verify_release.py classified changelog heading versions (e.g. ## 1.3.5.4 - ...) as global IPv4 literals.
This update narrows version-literal detection so changelog heading semver values pass while real global IP literals remain blocked.

• Verifier logic
  • Updated is_version_literal to treat markdown headings shaped as ## <version> - ... as version literals before global-IP rejection.
• Regression coverage
  • Extended scripts/test_release_workflow.py with a heading-specific assertion to lock behavior.
• Repository memory/contracts
  • Recorded the incident + fix in MEMORY.md and regenerated forensic inventory metadata.

candidate = data[start:end].lower()
if line.startswith(b"## ") and line[3:].split(b" - ", 1)[0] == candidate:
    return True

Compatibility

• Existing mailbox, ingestion, access-control, audit, public-site, and contact-service behavior is preserved.
• Database and deployment compatibility were reviewed.
• Any intentional breaking change is explicitly approved and documented.

Documentation baseline

• UI/design changes preserve original references and pass the design manifest and contract tests
• Planned or future-review controls remain inactive unless this PR contains the approved feature architecture
• A documents/phases/PHASE-NNN-*.md record was added or updated
• User-facing changes update USER_MANUAL.md, HOW_TO_USE.md, or ADMIN_GUIDE.md
• CHANGELOG.md was updated
• python scripts/manage_documents.py check
• python scripts/test_documents.py
• python scripts/manage_designs.py --root . check
• python scripts/test_designs.py
• python scripts/test_ui_foundation.py
• python scripts/check_documentation_policy.py --base HEAD^ --head HEAD

Verification

• Tests added or updated
• python scripts/forensic_audit.py --root . --profile essential --full
• python scripts/validate_templates.py
• python scripts/test_installer.py
• Dependency audit reviewed
• No secrets, production identifiers, user data, or generated artifacts added

Security and operations

No authorization, ingestion, retention, or runtime service paths changed.
Scope is limited to release-archive static validation heuristics; database schema, deployment flow, and migration/backup strategy are unchanged.
Rollback is straightforward by reverting scripts/verify_release.py and scripts/test_release_workflow.py.