doc-drift: release/PR metadata fetch is duplicated in scanner and precheck and costs N+3 gh calls per repo #129

Context

fetch_release_meta exists twice, verbatim: scripts/doc-drift-scanner.sh:67-92 and scripts/doc-drift-precheck.sh:56-83.

Measured against a fixture repo with three releases and a gh stub that counts invocations: 6 gh calls per repo in precheck and 7 in the scanner (the extra one is the rollup-issue lookup), i.e. 2 + one gh release view per tag + 1 gh pr list — 23 per repo at the --limit 20 ceiling. Precheck runs before every model turn, so this is the hot path, and the cost is paid twice once the scanner runs.

Per repo today:

1. gh release list --limit 20 --json tagName (:59 / :71) — a probe, result discarded, only used to decide whether to emit [];
2. the same gh release list again (:75 / :84), for --jq '.[].tagName';
3. N × gh release view <tag> --json tagName,publishedAt,createdAt,name,body (:70 / :79);
4. gh pr list --state merged --limit 100 (:80 / :90).

Proposal

One helper in scripts/github-api.sh — where gh_with_backoff, gh_issue_exists and close_issue_if_valid already live, exported through program-lib.sh — called by both sites:

fetch_release_meta <owner/name> <rel_json> <prs_json>

• releases in one call: gh api "repos/$repo/releases?per_page=100" --paginate (through gh_with_backoff), mapped with jq to the keys the checker already reads:
  [{tagName: .tag_name, publishedAt: .published_at, createdAt: .created_at, name: .name, body: .body}]
• PRs unchanged: one gh pr list --state merged --limit 100.
• Keep today's failure semantics: any gh error leaves [] in both files and never fails the repo.

Acceptance criteria

• One release call per repo (+1 per 100-release page) plus one PR call: ≤3 calls per repo, down from 23. The review said "21"; the measured ceiling is 23.
• The rel_*.json produced for a fixture is identical to today's gh release view output — same keys, same null handling — so release_date, release_draft and the draft-PR logic are unchanged. Fixture must include a draft release and one with publishedAt: null.
• Both call sites use the shared helper; no third copy.
• tests/test-doc-drift-fetch.sh (gh stub counting calls, same harness as tests/test-dep-bump-subset-carryforward.sh) asserts the call count and the fail-open path (gh exits non-zero → [], checker still runs).
• New test added to the explicit lists in .github/workflows/tests.yml (shellcheck list at :42, run list at :62-79); shellcheck clean at --severity=warning.

Notes

gh api .../releases returns drafts only with push access; when it errors the helper must fall back to [] exactly as gh release view failing does today. Out of scope: caching release metadata across runs.

Review follow-up from #124 (#pullrequestreview-5742023444).