CI: gate docs publication on release tags

[dknauss]

Summary

• add release-metadata validation for the benchmark source and changelog
• convert generate-docs.yml into a manual preview/build workflow
• move full PDF/DOCX/EPUB publication into the tag-driven release workflow
• narrow artifact-validation triggers so ordinary source edits do not require regenerated committed artifacts
• refresh the historical .planning/STATE.md framing so it no longer reads like active unfinished work

Why

This repo was publishing generated artifacts on ordinary main pushes, which makes version/date drift and artifact churn easy to introduce. This PR moves publication to the release boundary and adds an explicit metadata validator so version/date integrity can be checked separately from full artifact generation.

It also fixes the misleading bootstrap planning state, which still read as if Phase 1 were pending even though the repo has long since shipped.

Validation

• python3 .github/scripts/validate-release-metadata.py --markdown WordPress-Security-Benchmark.md --changelog CHANGELOG.md
• bash .github/scripts/verify-metrics.sh docs/current-metrics.md

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.