[release] Run release-gate maintenance tests before merge

[kang-heewon]

Priority

P1

Problem

Release-gate maintenance tests run only after a change reaches trunk. The current origin/trunk therefore passed every required PR check and then failed the Release workflow because ten production-ready-check fixture tests are broken.

This leaves the protected branch red and makes the post-merge release path the first place that publish-critical test drift is discovered.

Evidence

• PR fix: retain generated smoke failure artifacts in CI #1305 merged with validate and the review companion green: fix: retain generated smoke failure artifacts in CI #1305
• The resulting Release run failed in Release gate maintenance self-check: https://github.com/croco-dev/framework/actions/runs/29133661710
• Fresh reproduction at 5ddccef914d401181eae237890ae9b7c44b3c141:
  pnpm exec vitest run scripts/tests/production-ready-check.spec.ts --config vitest.config.ts
  reports 10 failed / 1 passed, all rooted at docs/package-catalog.json: spine must be an object.
• .github/workflows/release.yml owns a large maintenance-only Vitest list, while PR CI does not execute that same suite.
• Closed [release] Self-verify release-gate changes before the next publish #978 added the post-merge maintenance self-check; this issue addresses the remaining pre-merge gap exposed by the current failure.

Desired outcome

Every test that protects release-gate maintenance is green on the PR head before merge, while the post-merge Release self-check remains as defense in depth.

Proposed implementation

1. Define one root command, such as test:release-gates, as the authoritative release-maintenance test suite.
2. Invoke that command from PR CI when release workflow/gate inputs change. Prefer reusing the existing release-input classifier instead of copying another test list.
3. Invoke the same command from the Release workflow.
4. Repair the production-ready-check fixtures so their package catalog contains the current required spine shape.
5. Add workflow contract tests that fail if the PR and Release paths drift apart.

Acceptance criteria

• The current production-ready-check.spec.ts suite passes from a clean checkout.
• A PR changing a release-gate script, its test, or a direct policy input runs the authoritative maintenance suite before merge.
• The Release workflow calls the same command rather than maintaining a second test inventory.
• A deliberately broken release-gate fixture fails the PR check.
• Ordinary package-source changes do not gain an unrelated full release-publish job.

Validation

• pnpm exec vitest run scripts/tests/production-ready-check.spec.ts scripts/tests/release-workflow.spec.ts --config vitest.config.ts
• Run the new root release-gate test command locally.
• Exercise workflow fixtures for release-gate and ordinary source changes.

Scope boundaries

Keep the post-merge Release self-check. This issue is not a request to run the full publish pipeline on every pull request.