Deterministic archival ZIP capsule for museum

Create a small reproducible archival package for a fictional museum, not an application or website. Deliver capsule.zip, manifest.json, build_capsule.py, verify_capsule.py and README.md. Use Python 3 standard library only; no network, downloads or server. The ZIP must contain exactly three regular-file entries, in this exact order: README.txt with UTF-8 bytes for "Museum capsule v1\n"; data/café.txt with UTF-8 bytes for "Café — été\n"; data/empty.bin with zero bytes. The quoted \n means one LF byte, not a literal backslash followed by n. No BOM, implicit directory entries or additional archive entries. Use ZIP_STORED (no compression), timestamp (1980,1,1,0,0,0) for every entry, Unix creator metadata, mode 0o100644 in the upper 16 external-attribute bits, empty archive and entry comments, and empty extra fields. The non-ASCII filename must round-trip correctly. The archive must be byte-identical across two fresh builds and independent of wall-clock time and filesystem metadata. manifest.json is outside the ZIP and lists each entry's exact name, uncompressed byte count and lowercase SHA-256 digest. The builder creates both outputs deterministically. Define and document the manifest JSON shape. The verifier must independently contain the fixed expected names and payload bytes, check every required ZIP field, the entry order, exact payload bytes and CRC integrity, and cross-check every manifest row and digest. It must not trust the manifest as its expected truth or import constants from the builder. Return nonzero on mismatch, missing, duplicate or extra entries, or malformed input. Record real execution evidence: two fresh builds have identical archive and manifest bytes; verification accepts the final outputs; verification rejects a temporary copy whose first entry's stored payload has one deliberately changed byte with its original CRC unchanged. Remove only the temporary test material, preserving the five deliverables. Document exact regeneration and verification commands in README.md, with no claims about cryptographic signatures or long-term preservation guarantees.