validation: run CI and CodeQL for issue 427 stack

[jeremi]

Validation-only PR for the complete #427 implementation stack. Do not merge this PR.

Review and merge through the small stacked PRs:

• Reduce release latency without weakening release gates #428: release latency foundation
• release: add fail-closed finalization controls #431: fail-closed finalization controls and Dependabot release window
• docs: cache immutable archive builds #432: content-addressed docs archive cache
• release: verify and attest published release evidence #433: clean published verifier and signed release evidence

This main-targeted PR exists because the repository's CI and CodeQL workflows run only for pull requests targeting main or release/1.0. It provides the combined build and security signal while keeping the implementation PRs reviewable.

Local verification on this exact head:

• 295 release script tests
• 134 docs script tests
• full historical docs check and 175-page build
• actionlint, gate inventory, manual parser, schema, manifest, compile, and diff checks

[jeremi]

Validation review verdict: please do not merge this PR. Its evidence is now obsolete.

The validated stack predates the merged release reproducibility work, omits the final planner hardening that landed through PR #428, and is stale against current main. Please refresh the underlying PRs on the final release base and create a fresh main-targeted validation PR only after those fixes are ready. Until then this draft should be treated as historical validation evidence, not a beta-16 merge signal.

[jeremi]

Closing as obsolete validation-only scaffolding. The actionable release-process changes are being reviewed in their owning PRs (#431, #432, and #433), while beta-16 proceeds only with the confirmed release blockers in #440 and #434.