Fix v1.1 release candidate blockers

[BrettKinny]

What changed

• wait for the Compose entrypoint UID/GID remap before exercising the Workspace after create and recreate
• make container-produced Evidence files host-readable before atomic publication
• correct LazyGit's lowercase Linux release-asset name and exercise the production registry entry
• source Gum from a reviewed immutable multi-architecture OCI digest built with Go 1.26.2, asserting its exact development version and commit
• finalize v1.1.0 release-facing version references and document the OCI verification exception

Why

The v1.1.0-rc5 Candidate workflow failed before release preparation:

• Compose attempted to write /workspace before the dev identity remap completed
• setup requested a non-existent LazyGit asset name
• artifact upload could not read mode-0600 Evidence written across the container UID boundary
• Trivy found CVE-2025-68121 in Gum's embedded Go 1.25.1 standard library on amd64 and arm64

RC5 run: https://github.com/SquareWaveSystems/squarebox/actions/runs/29146735639

Validation

• all 17 executable repository test modules pass
• integrated image builds as v1.1.0-rc6-local
• smoke suite: 61/61 pass
• network-backed setup/editor/TUI suite: 35/35 pass, including LazyGit 0.63.0
• Evidence files are mode 0644 across the container/host UID boundary
• Compose create/recreate passes with baked UID 1000 remapped to PUID/PGID 1001
• Trivy 0.70.0 reports zero fixable critical vulnerabilities in the integrated amd64 image
• upstream Gum OCI members were separately scanned clean for amd64 and arm64

No manual UAT issue is closed by this PR. RC6 and the platform qualification matrix remain required.