Prepare PortCVE for verified signed releases

[Labeeb2339]

What changed

• completes the PortCVE rename across source, CLI, schemas, scripts, and public documentation
• adds offline known-advisory scanning for immutable local Docker image IDs and explicit local SBOMs
• hardens Trivy execution against inherited configuration, network/reparse paths, malformed evidence, hangs, and unsafe cleanup
• adds a file-backed, self-verifying PowerShell installer and fail-closed signed release workflow
• verifies RFC 3161 timestamps by decoding and binding the token to the Authenticode signer
• records dated Docker and vulnerability validation with explicit claim boundaries

Why

Port ownership, runtime mapping, firewall evidence, and known package advisories should be correlated without pretending that a bind is Internet reachable or a CVE match is exploitable. Release artifacts must also fail closed when signing or timestamp evidence is incomplete.

Validation

• locked restore passed
• Release build: 0 warnings, 0 errors
• .NET tests: 157/157
• PowerShell 5.1 installer checks: 35/35
• PowerShell 7 RFC 3161 binding checks: 9/9
• live Docker TCP/UDP integration and lock/check: passed
• snapshot schema validation: default and private/firewall outputs passed
• NuGet vulnerability audit: no known vulnerable packages
• Git history secret scan: no leaks
• all GitHub Actions references pinned to full commit SHAs

Release boundary

This PR publishes source only. Do not tag or claim 1.0 until a verified code-signing certificate, protected release-signing environment, exact signer subject, repository protections, and immutable releases are configured. The historical v0.1.0-alpha.1 artifact remains unsigned.