Verify release metadata without reserved runner variables

[KRISHNAMMurarka]

Summary

• verify the requested immutable tag against package metadata directly in the release workflow
• verify the exact checked-out tag and dated changelog section
• avoid GitHub reserved environment-variable behavior

Evidence

The protected release again stopped before publication because GitHub does not allow GITHUB-prefixed runtime values to be changed reliably. This implementation has no dependency on that namespace and leaves v0.1.1 untouched.

Verification

• npm run check
• workflow YAML parse
• shell metadata checks for v0.1.1
• git diff check

[edilec]

Direct metadata verification avoids reserved runner variables, preserves the immutable tag, and all required CI, dependency-review, and CodeQL checks pass.