feat(release): allow approval-gated Zi automation

[ss-o]

Summary

• name Zi as the only class-3 milestone-release automation exception
• keep maintainer-pushed signed tags as the publication authorization boundary
• let the reusable preparation workflow emit the signed-tag command for Zi
• document the fail-closed checks required before a Zi GitHub release is published

Instruction impact review

1. Classification: Shared release policy and reusable workflow behavior. Enforcement for the eventual Zi publication path remains in the Zi repository.
2. Contexts: The organization release policy, testing policy, reusable release preparation caller, and Zi maintainers consume this change. No runtime adapter changes are needed.
3. Canonical owner: ADR-0007 remains the release-model owner, ADR-0009 owns the related validation requirement, and runbooks/release.md owns the operational procedure.
4. Duplication or contradiction: Existing class-3 language was updated in both ADRs and the runbook. Zi is explicitly narrow, so the default prohibition remains consistent for every other class-3 repository.
5. Manifest routes: No route changes are needed. All affected files are already routed as release policy, testing policy, reusable workflow, or runbook content.
6. Runtime delivery: Yes. Mandatory rules live in canonical repository files and the workflow itself, without relying on an optional hook or skill.
7. Generated output and size limits: No generated instruction source changed. Public policy validation and all 84 agent-policy tests pass.

Validation

• python3 scripts/decision-records.py --check
• python3 -m unittest scripts/test_decision_records.py -v (17 passed)
• python3 scripts/validate-agent-policy.py
• python3 -m unittest scripts/test_validate_agent_policy.py -v (84 passed)
• actionlint .github/workflows/release-prepare.yml
• Ruby YAML parse with aliases enabled
• safe Trunk check on all four changed files
• git diff --check

Closes #583
Unblocks z-shell/zi#468