fix(release): install PyYAML before the claims registry gate

[abrichr]

The break

release.yml runs scripts/validate_claims.py --check --structure-only in two
jobs: create-release-tag (line 145) and publish-tag (line 285). That script
imports yaml at module scope. Neither job installs PyYAML. Both do checkout,
setup-python, and setup-uv, and nothing more, so the step dies immediately:

File ".../scripts/validate_claims.py", line 55, in <module>
    import yaml
ModuleNotFoundError: No module named 'yaml'
##[error]Process completed with exit code 1

Observed on run
33154231434
against d139db9. The job reaches it only after
check_release_ci.py has waited out the full main-branch CI, so each attempt
costs about 45 minutes before it fails.

This step has never passed

Worth being precise, because it changes what the fix is. This isn't a
regression. The step arrived in 9e9c33b (ci: require release App tag publication, Aug 26) without an install alongside it, and every release.yml
run since then has failed on it:

run	commit	result
33154231434	d139db9	failure
33150839273	d139db9	failure
33144645983	d139db9	failure
33138220411	4ab4155	failure
33137357847	4ab4155	failure
33136027151	4ab4155	failure

The last green release run is 32799646656 on Aug 25, which predates the step.
So no tag has been cut and nothing has been published since the gate went in.

The fix

Install PyYAML immediately before each claims step, copying the pattern and the
reasoning comment from validate-claims.yml:

- name: Install PyYAML
  run: pip install "pyyaml>=6"

The claims check itself is untouched. It's a real gate; it just couldn't run.

Installing the whole package would also supply yaml, but it drags every
runtime dependency into the release path, where a single bad transitive pin
would block publication. The narrow install can't do that.

Sweep of every other run: in the file

Each release job installs no Python dependencies at all, so I checked whether
anything else in release.yml would fail the same way one step later. Nothing
does. Every other script is stdlib-only:

script	non-stdlib imports
scripts/validate_claims.py	yaml
scripts/check_release_consistency.py	none
scripts/check_release_ci.py	none
scripts/verify_release_publication.py	none

The two inline python -c snippets use tomllib, and the heredoc uses os,
re, and subprocess. uv build gets uv from setup-uv.

Verified by running each one under a venv containing nothing but pip:

$ venv-bare/bin/python scripts/check_release_consistency.py
Release version 1.34.0 is synchronized across project, module, and lock.
$ venv-bare/bin/python scripts/validate_claims.py --check --structure-only
ModuleNotFoundError: No module named 'yaml'

And under a venv containing only PyYAML, which is what the fixed step builds:

$ venv-yamlonly/bin/python scripts/validate_claims.py --check --structure-only
Claims gate passed: 20 claims, 11 marked supported; registry structure is
consistent; no live pass was claimed.

So the sibling workflow's comment is still accurate: PyYAML plus stdlib, and
the gate passes on current main once it can import.

Wheel gate

release.yml is itself pinned in public-artifacts.json, so editing it changes
the reviewed digest. Regenerated with
python scripts/check_release_consistency.py --write-public-artifact-inventory.
The diff is one line, the entry for the file this PR edits:

   "path": ".github/workflows/release.yml",
-  "sha256": "2e9f30a2a2d902950423513eb49ce76c63eed958a7f6b22e318826e7282f74aa"
+  "sha256": "d8f1207dc1976a9d9e07622c2cc528687a07e0a3dddc23e512c40ceefc03154d"

ci.yml is not touched, and its pin is unchanged.

tests/test_release_contract.py and tests/test_validate_claims.py pass, 61
tests, including the four that read release.yml directly.

After merge

1.34.0 can be dispatched.