Release-note and release-intent gates miss verification notes, stale event payloads and Dependabot labels #125

Release notes and release labels still slip through the organization gates:

• verify-release-notes does not recognise verification and scope notes ("verified by building ...", "Storybook only", "not yet verified", "specs 492/492", "Tier 1 PASS"), provenance ("verified against Arc.TypeScript main (v0.34.0)"), or reviewer, merge and deploy instructions ("Stacked on Correct why verify-release-notes fails a (#n) inside an HTML comment #207", "retarget to main", "Draft:"). It also skips no-release and unlabelled pull requests entirely, and skips pull requests with more than one intent label.
• Both verify-release-notes and verify-release-intent read labels and body from the event payload, so "Re-run" replays stale labels and body.
• Dependabot adds major/minor/patch on top of the no-release configured in dependabot.yml, and several repositories (Samples, Common, ...) have no release-intent caller at all.
• Nothing warns when, after a merge from main, the notes describe changes the diff no longer contains.

Scope: stricter notes rules (warnings for no-release/unlabelled), live pull request reads in both gates, a Dependabot rule plus a reusable label normaliser, a bootstrapped verify-semver-label.yml caller with a per-file skip list, a warning-only drift job, and a regression corpus of published release bodies.