Improve diffbudget release check coverage

[rogerchappel]

What changed

• Hardened release:check so release dry runs exercise typecheck/check, tests, smoke coverage, and package packing through the canonical npm script.
• Switched the compiled test glob to dist/*.test.js so Linux CI does not pass an unexpanded dist/**/*.test.js pattern to Node.
• Pointed CI at the canonical release gate plus repository validation.

Why it matters

This makes PR and release evidence harder to accidentally weaken, and fixes the Linux CI test discovery failure that was already showing on dependency PRs.

Verification

• npm ci --no-audit --no-fund passed.
• npm run release:check passed.
• bash scripts/validate.sh passed.

Remaining limitations

• No package was published and no release tag was created.