Clarify release validation discipline

[GsCommand]

Motivation

• Make the path from “ready” to tag/pin/push explicit, reproducible, and harder to misuse by having one clear local gate and one clear release gate.
• Ensure mirror verification is explicit and opt-in for publish-time checks so routine CI remains stable while the final public verification is unambiguous.

Description

• Update package.json scripts to make npm run validate the canonical local/no-network gate (validate:current + checksum verification) and make npm run validate:release run the canonical local gate first and then the release-only checks (node scripts/validate-release.mjs).
• Strengthen .github/workflows/validate.yml by renaming the job to reflect release-readiness, running npm run validate before npm run validate:release, and adding a workflow_dispatch boolean input require_mirrors that triggers a publish-time mirror gate (npm run validate:release -- --require-mirrors) only when manually dispatched.
• Revise README.md to document the single canonical ceremony and recommended command sequence for a release, including npm run generate:dist-pin, node scripts/generate-checksums.mjs, npm run validate, npm run validate:release, tag creation, push, and final public mirror verification with npm run validate:release -- --require-mirrors.
• Files changed: package.json, .github/workflows/validate.yml, and README.md; the changes align script names, CI signaling, and documentation with a single clear release path.
• A maintainer can now follow one clean tag/pin procedure without ambiguity using the documented commands.

Testing

• Ran npm run validate locally and it completed successfully (local structure, manifest alignment, and checksums.txt verified).
• Ran npm run validate:release locally and it exercised the release checks but reported external upstream schema resolution failures (these external failures are expected to remain visible and not be silently masked).
• No CI failures were introduced by the workflow edits; the workflow now explicitly runs both gates and provides an opt-in mirror verification path for manual publish-time checks.

---

Codex Task