fix: reuse successful CI for releases

[aarikmudgal]

Summary

• Reused the successful exact-commit main CI and CodeQL results during automatic release publication.
• Added a fail-fast check that requires RELEASE_TOKEN to have repository push permission before release preparation starts.
• Removed repeated release-tool unit tests, simulator tests, static analysis, and simulator probes from the normal release path.
• Retained deterministic version/changelog validation, the exact two-file change allowlist, locked-package resolution, the unsigned iPhoneOS Release build, bundle metadata and signature verification, packaging, checksums, atomic tagging, and draft-first publication.
• Kept full validation reruns for explicit tagged recovery, which does not use the normal completed-CI trigger.
• Added [skip ci] only to the generated metadata commit, preventing a third redundant CI cycle after the already-validated release artifact is built.

Release flow

1. Pull requests run the full CI and CodeQL suite.
2. The merged main commit runs the full suite again.
3. A failed or cancelled main CI prevents Release from running.
4. A successful main CI triggers release-only preparation, device build, packaging, tagging, and publication.

Validation

• Passed all 21 release-tool tests.
• Parsed CI, Release, and Dependabot YAML files.
• Syntax-checked all 30 embedded workflow shell blocks with bash -n.
• Confirmed automatic and recovery conditions through parsed workflow structure.
• Confirmed release planning remains v0.2.0, build 2.
• Completed diff-hygiene and attribution scans with no findings.