chore: address Copilot review round 17

- ciRunsUnconditionally never looked at the workflow-level `on:` trigger, so a
  workflow switched to `on: release` still contained the step and reported as
  wired while no PR ever ran the validator. It now requires `push` or
  `pull_request`, handling all three shapes `on:` takes. The positive fixtures
  had no trigger at all, so they could not assert the "on every push" half of
  the contract; they carry one now, alongside a release-only negative. Verified
  by mutation.
- Stale JSDoc from the round-16 version change: `probeClaudeVersion` is now
  generic in its parser's result rather than hard-coding `number[]`,
  `validatorCommand` documents `{ parts, prerelease }`, and `runValidator`
  documents the `platform` option it already accepted. Annotations that lie make
  valid call sites look type-invalid.

Signed-off-by: cliffhall <cliff@futurescale.com>

scripts/lib/claude-cli.mjs

@@ -43,9 +43,15 @@ export function claudeSpawnArgs(
  * `--version` with something unrecognizable cannot be trusted to be the pinned
  * one either, and the callers all treat null as "use the pinned package".
  *
- * @param {(text: string) => number[] | null} parseVersion
+ * Generic in the parser's result: this helper only distinguishes "parsed" from
+ * "did not", so the shape is whatever the caller's parser returns — today
+ * `{ parts, prerelease }` from `parseClaudeVersion`. Hard-coding `number[]`
+ * here made valid callers look type-invalid (Copilot).
+ *
+ * @template T
+ * @param {(text: string) => T | null} parseVersion
  * @param {{ spawn?: typeof spawnSync, platform?: string }} [io]
- * @returns {number[] | null}
+ * @returns {T | null}
  */
 export function probeClaudeVersion(
   parseVersion,