chore: address Copilot review round 17

- ciRunsUnconditionally never looked at the workflow-level `on:` trigger, so a
  workflow switched to `on: release` still contained the step and reported as
  wired while no PR ever ran the validator. It now requires `push` or
  `pull_request`, handling all three shapes `on:` takes. The positive fixtures
  had no trigger at all, so they could not assert the "on every push" half of
  the contract; they carry one now, alongside a release-only negative. Verified
  by mutation.
- Stale JSDoc from the round-16 version change: `probeClaudeVersion` is now
  generic in its parser's result rather than hard-coding `number[]`,
  `validatorCommand` documents `{ parts, prerelease }`, and `runValidator`
  documents the `platform` option it already accepted. Annotations that lie make
  valid call sites look type-invalid.

Signed-off-by: cliffhall <cliff@futurescale.com>

scripts/verify-skills-cli.mjs

@@ -37,13 +37,14 @@ const SKILLS_DIR = ".claude/skills";
 /**
  * The argv that runs the pinned validator.
  *
- * A local CLI is used only when it matches `PINNED_CLI_VERSION` **exactly**.
- * Accepting anything at or above the floor would defeat the pin: a maintainer on
- * a newer CLI would validate against a different schema than CI's, so the same
- * `local:gate` could disagree across machines — which is the failure a pin
- * exists to prevent (Copilot). Everyone else runs the pinned package.
+ * A local CLI is used only when it matches `PINNED_CLI_VERSION` **exactly** —
+ * same release triple and no prerelease. Accepting anything at or above a floor
+ * would defeat the pin: a maintainer on a different CLI would validate against a
+ * different schema than CI's, so the same `local:gate` could disagree across
+ * machines, which is the failure a pin exists to prevent (Copilot). Everyone
+ * else runs the pinned package.
  *
- * @param {{ version: number[] | null }} local
+ * @param {{ version: { parts: number[], prerelease: string | null } | null }} local
  * @returns {{ command: string, args: string[], via: string }}
  */
 export function validatorCommand({ version }) {
@@ -80,9 +81,10 @@ export function validatorCommand({ version }) {
  * propagation of a rejected validator would leave `test:scripts` green while
  * this gate quietly stopped gating (Copilot).
  *
- * @param {{ probe?: () => number[] | null,
+ * @param {{ probe?: () => { parts: number[], prerelease: string | null } | null,
  *           spawn?: (cmd: string, args: string[], opts: object) => {error?: Error, status?: number|null},
- *           log?: (msg: string) => void, error?: (msg: string) => void }} [io]
+ *           log?: (msg: string) => void, error?: (msg: string) => void,
+ *           platform?: string }} [io]
  * @returns {number} Process exit code.
  */
 export function runValidator(io = {}) {