ci(release): enforce external contributor acknowledgements

[seakee]

Summary

Make external contributor acknowledgements a fail-closed part of release-content validation so a release cannot omit contributors that actually shipped.

Scope

• Frontend panel
• Manager Server
• CPA panel mode
• Full Docker mode
• Native packages / release
• Docs / Wiki
• CI / build / tooling

Changes

• Add bin/release/validate-release-contributors.mjs to resolve first-parent integration merges between the previous release tag and the frozen release-source dev SHA, map those merges to merged PR metadata, and collect external PR authors while excluding the repository owner and bots.
• Require the exact external contributor handle set in Chinese and English Acknowledgements sections and in Telegram GitHub profile links.
• Fail closed when a merge that is explicitly a GitHub PR merge cannot be mapped back to PR metadata.
• Run contributor discovery only for a release PR targeting dev; promotion PRs continue to validate the release files without repeating contributor discovery.
• Give the Release Content job only contents: read and pull-requests: read permissions for this check.
• Add regression coverage for contributor discovery, acknowledgement matching, classifier behavior, and workflow permission/trigger boundaries.

User Impact

No runtime behavior changes. Future releases with external contributors will fail Release Content if the contributor set is missing, incomplete, duplicated, or inconsistent across formal release notes and the Telegram source post.

Compatibility / Runtime Notes

• Release PRs still add the same three versioned release files.
• The validation uses the repository's existing release range convention and GitHub PR metadata; no new repository secret is required because it uses the job-scoped GITHUB_TOKEN with read-only PR access.
• Promotion PRs and ordinary documentation corrections do not perform contributor discovery.

Data / Security Notes

The new GitHub API access is read-only. No contributor metadata is persisted outside normal CI logs, and no write permission is added to the validation job.

Risk / Rollback

Risk level: Low to Medium. The change intentionally makes release preparation stricter; a contributor-resolution bug could block a release PR but cannot mutate release state.

Rollback by reverting this PR to restore the previous release-content validation behavior.

Verification

• Tests
• Docs/link check
• Type check
• Lint
• Build
• Manual UI check
• Not applicable, docs-only

Commands / evidence:

• Added isolated Vitest coverage for external contributor discovery and acknowledgement set validation.
• Added workflow-contract tests for read-only permissions, tag fetching, dev targeting, and frozen base SHA usage.
• Repository PR CI will run the full applicable check set because the PR changes workflow and classifier contracts.

Screenshots / Recordings

N/A — CI/release-process behavior only.

Docs

• README / README_CN updated for user-visible capabilities
• Matching docs manual and navigation updated
• Demo fixtures, screenshots, and deep links reviewed
• Release notes needed
• Not needed — explanation included below

Docs decision: release-process behavior is encoded in the validator/workflow contract; no end-user product documentation changes are required.

Related

Refs #742
Refs #746
Refs #773