release archives and packages do not include the user information document #133

Measured

• docs/user-information.md (no user information document with the contact, support period and secure-use details #128, PR State the support period and add a user information document #132) gathers the contact details, support period, secure use, updating, removal and SBOM location. Each release's copy is the one in that release's git tag only.
• Release archives contain exactly the binary, LICENSE, NOTICE, README.md and man/; .github/workflows/release.yml rejects any other top-level file. The .deb, .rpm and MSI payload checks enforce matching lists.
• Someone who installs from an archive or a package therefore gets no copy of the user information with the product, and depends on the repository's tags staying available.

Why it matters

The Cyber Resilience Act (Regulation (EU) 2024/2847) expects the information and instructions for the user to accompany the product (Art. 13(18), Annex II) and to stay available for the support period (Art. 13(15)). A copy shipped inside each release stays with the product even if the repository changes.

Acceptance criteria

• Every release archive contains docs/user-information.md (or a top-level copy with a clear name), and the archive content check in release.yml allows it.
• The .deb and .rpm packages install it under the usual documentation directory, and the MSI installs it next to the binary; the payload checks are updated.
• The container image includes it, or the README says where the image's copy is.
• docs/user-information.md and docs/verifying-releases.md say where the shipped copy is.

Depends on

#128 (PR #132).