Fix release consumer workflow dispatch contract

[fraware]

Final release-blocker fix discovered by live GitHub dispatch preflight.

GitHub rejected .github/workflows/consumer-pin-verification.yml with HTTP 422 (Workflow does not have 'workflow_dispatch' trigger) because fastapi_ref and express_ref omitted the required type field. This made the seven-workflow release-authority contract impossible to execute despite the YAML text containing workflow_dispatch.

This PR:

• adds type: string to both missing inputs;
• adds a repository-wide regression test requiring every workflow_dispatch input to declare a supported explicit type;
• adds a focused contract test for Consumer Pin Verification.

The current candidate 40fefb4de8b59978fa338fc09d3a185d5708bc1f is superseded by this fix and must not be tagged. After merge, the full exact-head pre-tag matrix and both consumer pins must be repeated on the new SHA.