fix(release): harden make-tarball's manifest writing the way #1311 hardened reading

[justinjoy]

Closes #1316. Stacked on #1330 (fix/1315-manifest-unescape) — review that first.

The change

make-tarball.sh wrote its checksum manifests missing the three hardenings #1311 applied to
the reading side. Each has a distinct failure, and each now has a fixture no other kills:

hardening	failure
CDPATH=	cd on a relative path lands in whichever CDPATH entry matched first — manifest written in the wrong place, or sha256sum finds no archive and the run aborts. release-tag.yml:274,344 pass a relative out_dir, so this is production shape.
--	an out_dir beginning with - is parsed as options by mkdir, dirname, basename and cd.
-P	cd is logical: with link -> y/target, x/dir/link/.. is y — the link target's parent — for the kernel that writes the archive, but x/dir for a logical cd.

Scope note: mkdir -p --

Line 22 is hardened although the issue's criterion 1 names only the two subshells. Without it
the -- hardening is unreachable — mkdir fails first with invalid option -- 'o', so no
fixture could kill it, while criterion 3 separately requires each hardening to be individually
killable. Those two criteria conflict as written.

Verified both directions: the mkdir-only mutant and the subshells-only mutant are each caught
by the dash fixture, so neither substitutes for the other.

Mutation matrix

mutant	FAILs
this PR	0
no CDPATH=	CDPATH case only
no -P	symlink case only
no -- (all)	dash case only
no -- (subshells only)	dash case only
no -- (mkdir only)	dash case only
pre-change	all three

Byte-identity holds (criterion 4): archive, .sha256 and .blake3 are cmp-identical to
pre-change output for an ordinary out_dir, and verify-release.sh round-trips them. Suite
passes under GNU bash 3.2.57 as well as 5.3.

What I got wrong, since it shaped the result

Two of my three fixtures were wrong before I measured them, and both passed against the
unhardened script while covering nothing: for -P I first used link/sub/.., where logical
and physical cd agree; for -- I used ./-outdir, whose dirname is ..

I described the CDPATH mechanism incorrectly in three places, and wrote a test assertion for
it. I claimed cd's CDPATH chatter is captured into the manifest. It is not — in
(cd DIR && sha256sum NAME > NAME.sha256) the redirection binds to sha256sum, not to cd.
The reviewer caught it and showed that the assertion I added for that mechanism
([ "$(grep -c . -- "$man")" = 1 ]) can never fire. Both the claim and the dead assertion are
gone, and the comment now states the binding explicitly so the error is not re-derived.

The -P example was off by one path component — I wrote "where the link points" when my
own measurement had shown the link target's parent.

Left out deliberately

make-tarball.sh:8's git rev-parse --verify "$ref^{commit}" also lacks --. Filed as
#1331 rather than folded in: the mkdir widening was forced by the criteria conflict
above, this one is not required by anything, and widening twice on my own judgment in one
change is how scope creep gets rationalised.