release-check

Pre-release gate covering tests, build, docs, changelog, privacy, security, and sprint closure. Delegates to `verify-build-works`, `secrets-scan`, and `privacy-audit` rather than re-checking by hand. Run before tagging a release, before closing a sprint, before a first deploy, and when the user says