fix(release): validate candidate workflows and next push checks

[roodboi]

GitHub rejected the merged prerelease workflow before any jobs ran: the stable tag glob treated + as a quantifier, and the reusable workflow referenced runner.temp where the runner context is unavailable. Escape the literal plus and select temporary build/publication paths through GITHUB_ENV on the assigned runner. Publication protection, exact-source checks and stable release isolation remain unchanged.

CI previously defined only a tag filter, so branch pushes did not schedule the exact next push checks required for publication. Explicitly admit main and next pushes while keeping pull-request CI and release-tag exclusion. Add pinned actionlint validation to the existing required model job, with the repository's Blacksmith runner labels declared, so syntax/context errors are caught before merge.

Validation: actionlint 1.7.12 reproduced all four GitHub validation errors on the original files and passes on the corrected CI/release/reusable workflow files. All 13 focused prerelease controls pass, including branch-push admission; typecheck, quality/privacy checks, changed-test lint and diff checks pass. Hosted required checks must pass on this exact head before merge. No tag or release was created by this fix.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}