fix(release): keep source verification dependency-free

[wolfiesch]

Root cause

The protected release verifier runs before dependency installation by design, but the consistency script reintroduced a static js-yaml import. Main CI concealed the regression because its tooling lane installs workspace dependencies first. The v0.1.31 release therefore failed before any build or publication.

Fix

• replace the runtime YAML dependency with scoped indentation-aware job and named-step extraction
• preserve the existing semantic checks within the two bridge-continuity jobs
• add a regression test rejecting third-party imports in the pre-install verifier

Verification

• all 23 release-consistency tests pass
• full tooling test suite passes
• pnpm check passes
• direct dependency-free release consistency check passes for v0.1.31

After this reaches current main, the existing immutable v0.1.31 tag can be repaired with the workflow_dispatch path.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c61bcf3324

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Require exact continuity-gate step values

The new text-only check treats required YAML fields as arbitrary substrings, so it no longer verifies the values that protect the release gate. For example, changing the legacy or current proof command to run: pnpm … || true yields no consistency errors (despite allowing a failed compatibility proof to pass), and a checkout's required repository/ref text can be moved into a YAML comment while the actual value points elsewhere. The previous parsed-object comparisons rejected these cases; preserve exact field validation rather than accepting a textual occurrence.

Useful? React with 👍 / 👎.