fix(release): resolve consumer subpackage dependencies

[moonyue-w]

Summary

Install the convention, forward, and managed packages at the exact release tag before building the clean consumer. This resolves their dependencies and writes the required consumer go.sum entries.

Why

The 0.6.0 release passed proxy visibility and source SHA checks, but consumer compilation failed with a missing github.com/coder/websocket checksum. The verification script fetched only the module root before creating a program that imports the SDK subpackages.

Failure: https://github.com/QoderAI/qoder-cloud-agents-sdk-go/actions/runs/38568900835/attempts/2

Verification

• Extracted the original and fixed consumer shell steps directly from the workflow and checked both with bash -n.
• Ran each in a separate temporary consumer with fresh module and build caches, using the public v0.6.0 package.
• The original step reproduced the missing go.sum error.
• The fixed step passed source SHA verification, exact version verification, dependency installation, and go build.

Impact

Only the release verification workflow changes. SDK source, API behavior, dependencies, documentation, and changelog are unchanged; live integration tests are not required. No credentials or generated test output are included.

After merge, resume by dispatching the updated main workflow with version 0.6.0, source SHA 1d7f987d83261036aa1f61074956ba04e512660a, and batch ID sdk-0.6.0-20261014-01. Reuse the existing tag; rerunning the old workflow would retain the faulty verification command.