make dist ships writ and lore and drops star #903

Context

make dist ships two of the three products. PRODUCTS := lore star writ, and .goreleaser.yaml's
default archive lists writ, lore, star; but .github/workflows/release.yaml runs make dist,
and dist-all builds and packs by hand:

go build ... -o dist/writ$ext ./cmd/writ
go build ... -o dist/lore$ext ./cmd/lore
tar -czf ... writ$ext lore$ext   |   zip ... writ$ext lore$ext

Verified 2026-09-21 against the release from develop a83653fe,
devlore-cli_v0.1.0-dev.20260921113422_windows_arm64.zip, checksum matching: it holds writ.exe
and lore.exe and nothing else. The same is true of every platform archive on that release.

The consequence on a box without a devlore-cli checkout: star cannot be installed at all, and
every rule that routes through it (agent rule 3, the issue report; rule 1, the verified build)
cannot be followed there. #339 covers star's LKG release and self-install and does not mention this.

Work

• dist-all builds and packs $(PRODUCTS), not a hand-written pair, so a product added to the
  list ships without a second edit. The archive name and checksum steps are unchanged.
• A check that fails the build when an archive's file list differs from $(PRODUCTS), so this
  cannot recur silently.
• Confirm goreleaser is not the shipping path, or make it so; two configurations describing one
  archive is how this drifted.

Plan and design documents