fix(ci): gate Classic Check on published locks

[zoeyrose]

Summary

Fix the Classic Check publication path so it verifies the pinned Classic
consumer's dependency lock before publishing immutable Windows candidates.
Keep candidate publication and the final smoke check on the same verified
consumer coordinates.

Implementation / behavior

• Validate the pinned Classic revision, workflow jobs, dependency tags,
  commits, asset URLs, and SHA-256 values as one bounded consumer contract.
• Run the dependency-availability and digest preflight before any immutable
  candidate is pushed.
• Retain the published-digest smoke test and native Classic Check validation
  as the final consumer checks before promotion.

Validation

• Run the repository's JSON, shell, Dockerfile, and workflow validation for
  the affected publication path.
• Verify the preflight rejects missing or mismatched Classic dependency
  assets without publishing a candidate.
• Run the applicable Classic Check smoke and publication checks on the final
  head; any external Classic lock prerequisite remains explicitly reported.

Limitations / follow-up

The Classic Content lock refresh tracked by classic#458
is a separate cross-repository delivery. This change does not modify Classic
or the unrelated Sound follow-up in classic#457.

Closes #34

[github-actions]

🎉 This PR is included in version 1.6.0 🎉

The release is available on:

• v1.6.0
• GitHub release

Your semantic-release bot 📦🚀