Fix zero-job workflow failure and add local preflight

[RobLe3]

What changed

• replace the unsupported workflow-level runner.temp expression with a workspace-relative disposable Cargo target
• keep quality validation on pull requests and explicit dispatch, avoiding a second hosted run after merge
• add a pinned local actionlint command and contributor guidance
• repair the manual release workflow without changing its manual-only publication authority

Why

The previous workflow definition failed before GitHub created any jobs because the runner context is unavailable in workflow/job env. An empty job set is a workflow failure, not successful validation.

Validation

• ./scripts/check_ci_workflows.sh
• dependency policy, format, clippy, and complete locked tests through the disposable Cargo gate
• package/worktree checks in the cross-repository local preflight

No package publication or deployment is included.