ci: validate Chrome Web Store packages

[TuYv]

Summary

• keep build.sh as the release entry point while moving its packaged paths to a shared allowlist
• validate the finished ZIP archive layout, manifest references, locale keys/placeholders, and privacy-policy source
• add real ZIP CLI regression coverage and upload a seven-day GitHub Actions artifact

Verification

• node --test tests/*.test.js
• bash -n build.sh
• workflow YAML parsed locally
• ./build.sh 1.6.1
• node scripts/validate-release.js pounce-1.6.1.zip
• git diff --check origin/master...HEAD

Scope

• no product behavior changes
• no manifest or browser-permission changes
• no automatic tag, release, or Chrome Web Store publication

Follow-up after merge

After Package validation succeeds on master, add that exact status context to ruleset 18852815.