Skill: validate-a-release

Run after release reports the GitHub release published. Every check runs on the artifacts users download, never on a local build. macOS arm64 host, MySQL on 127.0.0.1:3306 (pnpm dev:den:mysql), gh authenticated. Work from a clean checkout (evidence is bound to its git HEAD): origin/dev today; from the first release that ships these specs, the tag's own checkout (git worktree add /tmp/ow-vX.Y.Z vX.Y.Z) so the gate matches the binary.

1. Download and unpack

V is the release under test, B the previous release existing users update from.