fix: prepare isolation and check exact versions in release installation CI #828

Release 2026.10.21.1 exposed two verification preconditions after #827 was merged.

• The Homebrew installation jobs started before the formula update. Both jobs reported success while their logs identified 2026.10.19.1. Comparing the binary only to the installed formula does not prove that the released version was tested.
• Native ARM64 CN verification reached the public release assets but stopped before mcpp ran. The distro proot terminated with signal 11, and the existing bwrap option lacked the documented AppArmor preparation. The published xlings client already provides self doctor --isolation --fix for a root-owned backend and a narrow profile.

The CI preparation should resolve one release version for all installation jobs, wait for the tap to carry it without pre-tapping, and assert that exact version. The ARM64 CN workflow should use the supported bwrap setup rather than a private package-shaped symlink or a global user-namespace policy change.

This is verification maintenance. The sealed release assets, product behavior, scanner boundary and manifest schema remain unchanged. Validation must execute the published .21.1 binaries, retain the real build/run and consumer assertions, and preserve cold installation environments.