ci: align verification and library release workflows

[strider2038]

Normal CI and manual releases previously ran different verification paths, and publication pushed the changelog commit before checking its relationship to the validated SHA. Both now call the same repository-local reusable workflow, and publication verifies the release commit before pushing it.

Changes:

• Preserve project quality checks; add minimum-Go compatibility and pinned govulncheck v1.8.0 lanes, with tooling on Go 1.26.6.
• Reject empty or duplicate release-note sections and keep validation modes read-only.
• Prepare from the immutable candidate SHA; reject unexpected changes and stale branches before push.
• Verify the published version in an isolated consumer module using explicit public imports and bounded download retries.
• Document recovery and the required-check rollout.

Validation:

• actionlint v1.7.12 and shell syntax checks passed.
• Changelog and release-candidate/publication regression tests passed.
• Root go test -race ./... passed on Go 1.25.14 and Go 1.26.6.
• govulncheck passed on Go 1.26.6.
• Consumer smoke passed against already published v0.1.0; no release was created.

Rollout:

• Review branch-protection required-check names after adopting the reusable workflow.
• Hosted publication and repository token/branch rules have not been exercised locally.
• Minimum-Go vulnerability scan passed on Go 1.25.14. PostgreSQL, nested-module, differential, API and dependency checks remain required on both minimum and tooling lanes; the full database gate was not run locally.