test: preserve reusable workflow security contracts

[junwu168]

Problem

OpenPI PR #279 moves release and Feishu implementations into this repository, but the pinned revision did not preserve all behavior and security contracts that were previously tested alongside OpenPI.

Value

The reusable automation becomes independently reviewable and fails closed at the same boundaries as the original project-local workflows.

Approach

• Expand Feishu coverage for metadata sanitization, injection resistance, Unicode bounds, secret pairing, HMAC payloads, and response failures.
• Move secret-pair enforcement into the tested Feishu action.
• Add a tested release-validation action for event/ref/tag and checked-out package-version validation.
• Add reusable-workflow contracts for draft suppression, immutable action pins, ancestry, OIDC/environment boundaries, and single-artifact publication.

Validation

• npm test — 16 passed.
• YAML parsing for all workflows and action manifests — passed.
• git diff --check — passed.

Impact

Feishu and release behavior remains compatible while gaining executable fail-closed contracts. No secrets or repository-specific CI move into this repository.