Run fixture validation in the release gate

[rogerchappel]

Summary

• make fixture validation concurrency-safe with a unique temporary directory and cleanup trap
• add a focused JSON assertion and exercise its rejection path deterministically
• include npm run validate in the CI-backed release gate without recursively rerunning the full gate
• align the README release-gate inventory with package.json

Commits

• 94ccf44 fix: make fixture validation isolated
• 9a20013 ci: include fixture validation in release gate
• b46d4b4 docs: align release gate inventory

Verification

• npm ci --ignore-scripts --no-audit --no-fund
• npm run validate
• npm run release:check (101 tests, coverage, audits, typecheck, lint, CLI smoke, fixture validation, package smoke)
• git diff --check origin/main...HEAD

The direct and full gates leave no repository or shared fixed-path validation artifacts.

[rogerchappel]

Automated merge note

Triage class: auto-merge

Summary: Routine CI/release-gate validation improvement (4 files, +35/-9); no manual-extreme categories detected.

Checks run: CI test matrix (Node 20.19.0, 22, 24) — all SUCCESS; final diff, mergeability, branch protection, and head SHA re-verified.

Rebased/CI-repaired: No.

Verified head SHA: b46d4b4