ci: filter non-user-facing CLI release notes

[MLittleprince]

Summary

• deterministically remove Doc Agent release items backed only by known CI or release-automation commits
• strip known non-user-facing refs from otherwise valid user-facing items
• preserve strict fail-closed behavior for unknown refs, missing required feature coverage, invalid copy, and unavailable Doc Agent responses
• record evidence curation in release-notes-draft.json and quality-report.json
• strengthen the Doc Agent request and repair instructions to use required_source_refs only

Production failure reproduced

The regression test mirrors failed dry-run 32011023224:

• required user-facing evidence: a6199ed / PR feat: add DeepSeek Harness agent integration #30
• non-user-facing refs incorrectly returned by Doc Agent: 9c57e9c and cd568a3
• expected result: keep a6199ed / feat: add DeepSeek Harness agent integration #30, remove the automation-only item, validate with 1/1 coverage and zero issues

The same transformation was also verified against the downloaded evidence.json from that run.

Validation

• node --test .github/scripts/prepare-cli-release.test.mjs .github/scripts/resolve-cli-release.test.mjs: 71 passed
• node --check for both release scripts
• bash syntax checks for publish-cli-release.sh and build-binary.sh
• git diff --check
• sensitive information scan of the added diff

Safety

This PR does not create a tag, GitHub Release, Docs PR, or deployment. If Doc Agent returns only automation content, unknown source refs, or misses the required product change, the workflow still fails closed.