chore(core): clear dead-code biome warnings in packages/core

[lukaso-bot]

What

Clears the three gate-tolerated biome warnings in packages/core (the core
counterpart to #95, which did the same for packages/web). All
behavior-preserving.

Changes

• src/release-notes.ts — !markdown || !markdown.trim() →
  !markdown?.trim() (useOptionalChain). Equivalent on null/""/" ".
  release-notes.ts is the release-body sanitization surface, so a tolerated
  lint warning here is the worst place for one.
• test/find-release-bulk.test.ts — drop unused makeGitlabProvider import.
• test/github.test.ts — drop a dead const fetch = queuedFetch(...) left
  over from an earlier draft. The rate-limit test uses the inline fetch
  passed to makeGithubClient (with full x-ratelimit-* headers); the line-342
  binding was never referenced.

Verification

• pnpm --filter @released/core exec biome check: 3 → 0 warnings.
• pnpm -r build + pnpm -r typecheck: green (4 packages).
• pnpm -r test: green — 256 core / 45 cli / 220 web / 13 web-og.
  The touched rate-limit test run by name (throws RateLimitError on 403 with remaining=0) passes, confirming the deleted binding was dead.
• ./scripts/validate.sh: green (shellcheck, actionlint, gitleaks, publint, osv).

Trivial dead-code / style cleanup; no external-tool behavior to verify beyond
the linter + tests.

[lukaso-bot]

In-house adversarial review (Copilot perpetually quota-blocked → in-house pass). Verified all three changes are behavior-preserving:

• release-notes.ts !markdown || !markdown.trim() → !markdown?.trim(): equivalent. markdown is typed string, so ?. is a no-op for the declared type. At runtime it's also equivalent — null?.trim() / undefined?.trim() → undefined → falsy → returns null, same as the old !markdown short-circuit. The "Returns null for empty/whitespace" contract holds for "", " ", null, undefined. This is the release-body sanitization surface, so good to have clean.
• find-release-bulk.test.ts makeGitlabProvider import: appears only on the import line — not referenced in the file. Dead import.
• github.test.ts const fetch = queuedFetch(errResp(403,…)): that binding was never consumed — makeGithubClient is handed the inline queuedFetch(...) with the full x-ratelimit-* headers. The 5xx test below keeps its own fetch. The rate-limit test still asserts RateLimitError on a 403-with-remaining=0 response, so coverage is intact.

Trivial dead-code/style cleanup. Cleared.