fix(release): validate merged release PRs through the pinned contract

[chhoumann]

Rewrites the reusable validate workflow (stage 2) so its version-file semantics come from the pinned release-contract script instead of a second inline implementation, and gives it an explicit recovery path for merged release PRs that failed validation.

Contract consolidation (#6). The validate job now checks out the toolkit at workflows-ref, derives the release-file set from release-contract.mjs files, downloads the version files at the base, release, and previous-tag commits (raw bytes via the contents API - it still never checks out consumer code), and runs the new release-contract.mjs validate-release command: validateReleasePr (branch/title/base/same-repo/changed-files shape) composed with validateVersionFiles (synchronized versions, progression, floor rules including the pending minAppVersion raise from #3) and validatePreviousTagHistory plus tag identity/floor checks. The inline reimplementation of version parsing, floor comparison, recorded-floor lookup, and the pending-floor exception is gone; prepare, validate, and release now share one semantic model. API-shaped forensics (PR provenance, commit structure, tree SHA, ancestry, tag resolution) stay inline, and the recovery-branch + dispatch writes moved to a separate step that only runs after the contract passes.

Recovery path (#9). The EVENT_SHA === releaseSha pin made any post-merge recovery impossible once the default branch moved (PodNotes 2.19.3, chhoumann/PodNotes#291/#293). Validate now accepts exactly two event identities: the merge event (default branch at the merge commit, unchanged predicate) or an explicit workflow_dispatch from the current default-branch head - the same trusted recovery source model stage 3 already uses. Everything else is re-derived from the PR number and fails closed; the stage-3 higher-tag and tag-target checks make a replayed old release inert. The trigger stub template gains the workflow_dispatch recovery trigger and a workflows-ref pin, and the README documents dispatch recovery as canonical with webhook redelivery as the merge-time-exact alternative.

Also included, kept in lockstep with the rewrite:

• release-run namespace preflight in the dispatch step (same failure mode as release-prepare: preflight the release/* refname namespace before createRef #10's release branch, but it would strike after the maintainer already merged).
• workflows-ref defaults bumped to v3 across the three reusables; templates pin @v3 and set an explicit release-policy (follow-up to Make commit-to-release policy a consumer input instead of toolkit constant #7 so a toolkit ref move can never change a consumer's classification).
• README: recovery section, release-policy docs, stray-branch migration-checklist item, updated lockstep guidance.

Fixes #6
Fixes #9