Move agent server.toml demo-key drift gate into the release build pipeline

Background

PR #1677 ships endpoints/agent/main/etc/server.toml defaulting to the public demo (server.opennhp.org). To keep the committed demo keys in sync with the live opennhp/demo secret, an advisory drift check exists in .github/workflows/deploy-demo-v2.yml (step "Check server.toml demo-key drift").

Problem

That guard sits in the wrong pipeline:

• deploy-demo-v2.yml is workflow_dispatch-only and gated on inputs.confirm == 'deploy', so it never runs on a PR.
• That pipeline does not build nhp-agentd — the drifted file is shipped by build-binaries.yml (Makefile:138 copies endpoints/agent/main/etc/*.toml verbatim into the release archive).

So the file that actually reaches users is never checked against the live secret at the point it's packaged.

Proposed fix

1. Add a drift check to build-binaries.yml on the create_release == 'yes' path — read opennhp/demo and assert the committed PubKeyBase64 values match before archiving.
2. Optionally add a cheap PR-time job that verifies the layout is internally consistent (active Curve block + commented SM2 block both named default) without needing secret access.

Notes / non-blocking cleanups (spotted alongside)

• The advisory guard hardcodes the "Curve active / SM2 commented" orientation; a layout swap would false-trip it.
• note() writes literal ::warning:: markers into $GITHUB_STEP_SUMMARY.
• --regenerate runs leave operator homework (peer tables must be redeployed in lockstep).
• register menu option [2] GMSM fails silently when the resolved cluster key length doesn't match the scheme — consider a fail-fast length check.

Split out of #1677 review so the demo-config PR isn't blocked on release-pipeline plumbing.