fix(release): allow non-selectable schema statuses in discovery test

[bokelley]

Summary

• allow exact stable-semver artifacts to carry withdrawn or unpublished discovery status
• keep prerelease: false for those exact artifacts
• strengthen alias and latest_stable assertions so every selectable target must resolve to a discovered entry with stability: stable

Why

The 3.1.6 release audit exposed a stale assertion in test:dist-schema-version-ids: 3.1.3 is intentionally preserved as an exact-addressable withdrawn artifact, but the test still required every stable-semver directory to report stability: stable. This contradicted the release-status behavior added in #5913.

Validation

• npm run test:dist-schema-version-ids — 2/2 passed
• npx vitest run tests/schema-release-status.test.ts — 2/2 passed
• precommit suite — 1,022 repo unit tests, dynamic-import lint, callApi lint, and TypeScript typecheck passed
• git diff --check — passed

No changeset: test-only release tooling correction; no protocol surface change.

[aao-secretariat]

Clean fix. Loosens the per-directory stability assertion to match the release-status model from #5913 while tightening the invariant that actually matters — selectable targets must resolve to a discovered, stable entry. Fail-closed beats fail-open.

Things I checked

• The three accepted stability values are real, not phantom. scripts/build-schemas.cjs:44-45 defines exactly ['3.1.3', 'withdrawn'] and ['3.2.0', 'unpublished']; the loosened check at tests/dist-schema-version-ids.test.cjs:104 accepts ['stable', 'withdrawn', 'unpublished']. No fourth status can slip through — the assert.ok fails closed with the offending value in the message.
• The prerelease: false assertion that survives the loosening still holds for both non-stable statuses. build-schemas.cjs:145 (withdrawn) and :153 (unpublished) both emit prerelease: false, so keeping assert.equal(entry.prerelease, false) on every stable-semver dir is correct, not accidental.
• assertSelectableStableTarget is a net strengthening, not a loosening. Before this PR, alias targets were only regex-matched against the stable-semver shape; nothing verified the target resolved to a discovered entry with stability: stable. Now latest_stable and every alias must resolve through entriesByVersion to a stable, non-prerelease entry — so an alias pointing at withdrawn 3.1.3 would fail. That is the exact hole the 3.1.6 audit exposed.
• Lineage checks out: #5913 is fix(release): preserve schema release status, and the test was the stale half of that behavior.

Follow-ups (non-blocking — file as issues)

• None.

Minor nits (non-blocking)

1. Redundant-but-harmless double check on aliases. tests/dist-schema-version-ids.test.cjs:85 keeps assert.match(version, stableVersion, ...) and :86 adds assertSelectableStableTarget(version, alias). The helper's entriesByVersion lookup plus stability: stable subsumes most of what the regex proves. Not worth a change — the regex gives a sharper failure message for the malformed-alias case.

No changeset required — test-only release-tooling correction, no static/schemas/source/** or wire surface touched. Validation in the PR body (dist-schema-version-ids 2/2, schema-release-status 2/2, precommit suite green) covers the path being changed.

Approving on the strength of the generator/test coherence check plus the alias-resolution tightening.