fix(release): keep internal notes out of Sparkle

[caezium]

Fix the contributor-only RELEASES.md comment that Sparkle renders as visible update text.

• remove the leaked HTML comment from the 0.11.2 notes source
• reject HTML comments, stale headings, and accumulated releases before appcast generation
• verify embedded Sparkle Markdown matches the validated source byte-for-byte
• add a manual, fail-closed repair workflow that preserves the notarized app ZIP and re-signs only the current release appcast
• document the runtime-facing release-notes contract and exceptional repair procedure

Verification:

• python3 -m unittest discover -s scripts/tests -p 'test_*.py'
• actionlint .github/workflows/release.yml .github/workflows/repair-sparkle-release-notes.yml
• python3 scripts/validate-release-notes.py RELEASES.md --version 0.11.2
• confirmed the currently published v0.11.2 appcast fails the new exact-notes check before repair