NormalizedGitHubReleases source brand

Chose branded NormalizedGitHubReleases over inferring provenance from tag syntax because stripped SemVer tags cannot prove whether data came from Toolkit or legacy. normalizeStableReleases() rejects drafts, GitHub/SemVer prereleases, malformed versions, and wrong prefixes, then stores a non-enumerable structural key from githubRepo, ghcrRepo, and tagPrefix. Release notes may reuse prefetched data only when isNormalizedForSource() matches; raw or opposite-source arrays produce no changelog.