Fix release gate workflow identity binding

[YanagiKH]

Summary

• resolve trusted check-suite IDs from exact main push runs of .github/workflows/ci.yml and .github/workflows/security.yml
• use those IDs when evaluating required check runs in preflight and both final publication rechecks
• avoid relying on the abbreviated check_suite object embedded in the check-runs response

Evidence

• the live check-runs API embeds only check_suite.id
• the Actions runs API binds run path, event, branch, SHA, repository, and check-suite ID
• Prettier and git diff --check pass locally

The first tag-triggered preflight was cancelled before any draft or release asset was created.