ci(workflows): validate client-id migration and gate release PR readiness

## Issue Description

Before the `client-id` migration PR is opened or marked ready, run targeted static validation on the edited release workflows and confirm the configuration prerequisite is already satisfied.

Depends on #2511.

Validation commands (run after a recent root `npm ci`):

- `npm run lint:yaml`
- `npm run lint:dependency-pinning`
- `npm run lint:version-consistency`
- `npm run lint:permissions`
- `npm run lint:dangerous-workflow`
- `npm run validate:copyright`
- `git diff --check`

Acceptance criteria:

- [ ] Every targeted command passes
- [ ] Action-version consistency accepts `v3.2.0` for the retained SHA
- [ ] The diff remains limited to the three release workflow files
- [ ] Configuration evidence confirms `RELEASE_APP_CLIENT_ID` existed at repository scope and was verified before the first PR revision containing the migration
- [ ] The PR description names `RELEASE_APP_CLIENT_ID` and states that repository-scope configuration was verified, without including the value
- [ ] No Client ID or private key value appears in the diff, commit messages, PR text, or logs

## Additional Context

`actionlint` (via `npm run lint:yaml`) validates syntax and expression shape only. It does not query repository settings, so a passing run is **not** evidence that `RELEASE_APP_CLIENT_ID` exists, is spelled correctly, or holds the right value. The administrative verification and this static validation are two separate required gates.

Do not add tests or modify validation scripts for this input-only migration.