fix: validate bot-created release pull requests

[loonghao]

Summary

• validate Release Please PR metadata and changed files from trusted main code
• publish PR Title and CI success statuses when GITHUB_TOKEN suppresses PR events
• keep the event-driven gate on the same validator and allow Cargo.lock as optional

Validation

• vx python -m unittest discover -s scripts/tests -p 'test_*.py'
• vx uvx:ruff check scripts/validate_release_pr.py scripts/tests/test_validate_release_pr.py scripts/tests/test_release_please_workflow.py
• vx actionlint .github/workflows/release-please.yml .github/workflows/ci-release-pr.yml .github/workflows/pr-title.yml
• vx just hakari-verify