fix(release): sanitize public release notes

[MLittleprince]

Summary

• remove reserved Doc Agent audit comments before publishing RELEASE_NOTES.md
• preserve auditability through RELEASE_EVIDENCE.json, RELEASE_NOTES_SOURCE.json, and QUALITY_REPORT.json
• fail closed for malformed or inline reserved metadata while preserving ordinary comments and fenced examples

Validation

• npm test
• npm run lint
• npm run version:check
• git diff --check
• read-only replay against the v1.1.2 RELEASE_NOTES.md asset

Safety boundary

• changes only the memmy-agent Draft Release workflow, sanitizer, and tests
• does not change or deploy website, 106, or memmy-web
• does not create or publish any tag or Release
• keeps the human Publish boundary and structured evidence assets unchanged

This fix should merge before the next release branch is merged into main.