ci(release): validate the post-version tree before the version PR is opened (#11964)

* ci(release): validate the post-version tree before the version PR is opened

The "chore: version packages" PR runs no CI: changesets/action opens and
force-pushes it with the default GITHUB_TOKEN, and GitHub does not start
workflow runs from events raised by that token. So the largest
machine-generated diff of the release cycle is the only commit that reaches
main without passing the gates. Two files in this repository already state
that mechanism -- lint.yml's docs-image-tag block and
scripts/sync-protocol-version.mjs's header -- and each states it while
explaining a rewriter built to work around it.

Render the post-version tree in the version-pr job, validate it, and put it
back before changesets/action reads it. The gate list is derived from the
change set by scripts/pm/dispatch-gates.mjs rather than written down, so a
fifth version-time rewriter pulls in its surface's gates on the day it lands.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015ahemw8RcTgqtxrj15PEZx

* ci(release): scope the post-version check to a shape assertion + the gates that read it

Replaces the first draft's derive-and-run selector. Feeding the change set to
scripts/pm/dispatch-gates.mjs named 49 families and ran 44 of them green in
113 s, but running the tool in CI needs check-self-test-wired.mjs to grow a new
ledger shape, and check-dispatch-gates.mjs already records the reviewed position
that the live derivation has no verdict for CI to hold. That is a maintainer's
call, not a rider on this card.

What ships instead is two halves: a shape assertion that resolves the doc and
template surfaces at run time from the declarations the rewriters themselves
read (cut-rc.yml's idiom, same predicate), so a new version-time output reddens
this lane on the day it lands; and the eight gates whose corpus is what the
version step actually writes, measured at 7 s.

Also corrects this job's comment, which called `pnpm run version` three
rewriters after #9064 made it four.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015ahemw8RcTgqtxrj15PEZx

* ci(release): give the major-boundary surfaces their own refusal

Reverse verification caught the routing: with protocol-version.ts missing from
the shape filter's pattern, a major train's output fell into the "wrote outside
the reviewed post-version surface" branch -- red for the right reason and wrong
about why, on a lane whose refusals are supposed to name the remedy.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015ahemw8RcTgqtxrj15PEZx

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]