Release reproducibility

[hasufell]

Releases should:

1. point to the gitlab pipeline that built the artifacts, like GHC https://downloads.haskell.org/ghc/9.2.3/metadata.json
2. package plan.json in the tarball
3. the index state that was used to build