chore: harden createEvents contract and release checks

[aose-yuu]

Purpose

Harden the createEvents contract and release guardrails before downstream headless/UI packages rely on them.

Summary

• Adds guard coverage for listener completion and molecule-scope disposal in event channels.
• Routes CI and publish validation through the package cicheck script so smoke checks run on both PRs and release tags.
• Keeps release creation on explicit SIGREA_RELEASE_VERSION and removes the old inferred-version tasks.
• Updates README, contributing guidance, and the PR checklist to match the current release flow.

Verification

• pnpm -s cicheck