fix: validate releases before publishing

[Addono]

Summary

• move release-candidate validation into its own job before semantic-release runs
• rebuild the CLI with the resolved release version before validation so versioned binary checks stay accurate
• make the gh extension integration test compare against the installed checkout entrypoint instead of inferred release state

Validation

• npm run lint
• npm run format:check
• npm run typecheck
• npm run build
• npm test
• simulated release validation with GH_ATTACH_BUILD_VERSION=9.9.9