CI: gate docs publication on release tags

[dknauss]

Summary

• add release-metadata validation for the runbook source and changelog
• convert generate-docs.yml into a manual preview/build workflow
• move full PDF/DOCX/EPUB publication into the tag-driven release workflow
• narrow artifact-validation triggers so ordinary source edits do not require regenerated committed artifacts
• keep the earlier artifact-version validator fix, now backed by the new release boundary

Why

The runbook was still set up to publish generated artifacts on ordinary main pushes. That means routine editorial merges can silently mutate the publication outputs and blur when version/date updates are actually meant to happen. This PR makes tagged release publication the explicit boundary instead.

Validation

• python3 .github/scripts/validate-release-metadata.py --markdown WP-Operations-Runbook.md --changelog CHANGELOG.md
• bash .github/scripts/verify-metrics.sh docs/current-metrics.md

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.