test: harden release candidate gates

[cucuwang]

Summary

This follow-up makes the v0.6 release checks executable and artifact-bound rather than relying on a manual runbook alone.

• adds a clean-worktree release:check that runs tests, build, Action contract, audit, a real npm pack, required-file checks, and all three CLI aliases from the exact packed tarball;
• runs the candidate gate on Node.js 22 and 24, uploads manifests, and fails CI unless version, filename, SHA-256, file count, and unpacked size match;
• binds the public release verifier's CLI smoke tests to the downloaded tarball whose SHA-256 was verified;
• adds fail-closed verifier cases for a missing alias, wrong tag target, draft Release, and repository identity drift;
• exercises every public rule fixture across the HTML parser boundary and strengthens the JSON/Action sample contract checks;
• corrects two self-contained-statement fixtures whose short paragraphs were discarded by the real HTML parser.

Why

PR #3 added the release evidence, but independent review found three reliability gaps: the documented candidate checks were not one executable prepublish gate, the verifier hashed one tarball and installed the package again by registry spec, and the rule corpus bypassed the parser. This patch closes those code-level gaps without changing scoring behavior.

Validation

Run from clean commit c7a843e1cd14c04a84c5302921464dec901ea64a:

Gate	Node 22.23.2 / npm 10.9.4	Node 24.11.1 / npm 11.19.0
Vitest	8 files, 156 tests passed	8 files, 156 tests passed
TypeScript build	passed	passed
Action contract	passed	passed
npm audit	0 vulnerabilities	0 vulnerabilities
candidate pack	55 files	55 files
candidate SHA-256	ad3780e2c5478e8f53647a3f6c23cdb5d9f1d5da7e37e34b4249c6458a061721	same

Additional checks:

• public v0.6.0 verifier still passes against merge commit 47579e56393d8b91476065108f85e7913b60d80d and published tarball SHA-256 f5ea2dbb4d15732fc095b7d8e8805b9381fb007f81243ee36e2caad4fa1d58c1;
• npm publish --dry-run completed the new prepublishOnly gate, then stopped because 0.6.0 is already published;
• git diff --check passed and the worktree is clean.

Release boundary

This PR does not bump the package version, publish npm content, create or move a tag, create a GitHub Release, or change repository rulesets. The new local candidate hash is not the published v0.6.0 artifact and must not be published over the existing immutable version. A future release should bump the version separately.

Review checklist

• Candidate verification installs the same tarball it hashes.
• Node 22 and 24 manifests must match before CI passes.
• Dirty worktrees fail before candidate creation.
• Public verifier negative cases fail closed.
• Parser round-trip covers all scored-rule fixture cases.
• No scoring rule, weight, public JSON field, or Action input/output changed.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.