Harden TUI recovery paths and add release integrity gates

.github/workflows/tests.yml

@@ -30,6 +30,8 @@ jobs:
         run: |
           poetry run pip-audit || echo "::warning::pip-audit found vulnerabilities"
         shell: bash
+      - name: Run deterministic regression tests
+        run: poetry run pytest -q src/tests/test_deterministic_artifact_regression.py
       - name: Run tests with coverage
         run: |
           poetry run coverage run -m pytest