ci: improve voter verification script

[andreahlert]

Part of #715

Problem

The current `scripts/verify_apache_artifacts.py` covers basic checks (GPG, SHA-512, file presence), but does not verify reproducible builds or automate the full voter workflow.

Solution

Extend the verification script to:

1. Rebuild from source and compare checksums against the SVN artifacts (requires ci: reproducible builds with SOURCE_DATE_EPOCH #716 reproducible builds)
2. Run Apache RAT license check automatically
3. Check that `DISCLAIMER`, `LICENSE`, `NOTICE` are present and correct in all artifacts
4. Verify that the wheel includes the correct `LICENSE` files (related to 0.42 RC omits MIT License info from LICENSE-wheel #712)
5. Print a summary with pass/fail for each check
6. Optionally output a vote email draft with the verification results

Acceptance criteria

• Reproducible build verification (rebuild + compare)
• Apache RAT check integrated
• LICENSE/NOTICE/DISCLAIMER presence check in all artifact types
• Clear pass/fail summary output
• Vote email draft generation (optional flag)

[andreahlert]

@skrawcz @pjfanning the current verify_apache_artifacts.py covers GPG and SHA-512 but doesn't do a rebuild-and-compare check. once #716 lands we could add that. also thinking we should check LICENSE/NOTICE inside the wheel automatically, would've caught #712 earlier. any other checks you'd want?