scripts(verify-pr-checks): key the skipped-publish allowance on the release.yml check suite, not the job name

[dean0x]

Context

PR #338 added a TIER_B_EXPECTED_SKIPPED allowance (scripts/verify-pr-checks.mjs) to permit the three tag-guarded release.yml publish jobs to skip with conclusion=skipped when the script runs on a PR head (the tag-guard means those jobs never run on pull_request, but their check-run shows skipped when referenced via the merge commit).

The current implementation keys the allowance on job name only (three hard-coded strings). Name-only matching is weaker than needed: any workflow that runs on pull_request from the merge commit could introduce a job with the same name and a false if: condition, passing Tier B where it previously failed.

Problem

Impact is low in practice (required and EXPECTED_CONTEXTS names are presence-checked independently; fork tokens are read-only), but the key is insufficient and brittle.

Proposal

Key the skipped-publish allowance on the release.yml check suite identity rather than job name. Options:

1. Require the check-run's suite or details_url to belong to release.yml (extract workflow filename from suite field in the GitHub Checks API response).
2. Require all three job names to appear together as a single dry-run signature (they are always together in release.yml and unlikely to collide with other workflows).

Acceptance Criteria

• scripts/verify-pr-checks.mjs no longer keys the allowance on job name alone
• The new key (suite identity or signature) is documented in code
• Spec suite (scripts/test/verify-pr-checks.spec.mjs, D-PR5a-e section) validates the new logic
• A PR that edits release.yml can pass Tier B without introducing false allow-list passes

Related

Relates to PR #338