ci: keep local plugin release scripts trusted

[MLittleprince]

Summary

• keep local-plugin package source refs separate from trusted release automation scripts
• always run .github/scripts from the workflow revision, even when git_ref points at older source code
• request multiple Doc Agent candidates and preserve complete quality diagnostics
• upload a redacted failure artifact when release notes fail validation
• avoid duplicate outer retries for deterministic quality rejections

Why

Run 30809108630 checked out older release scripts through git_ref, so a beta package-only release incorrectly called the Doc Agent.

Run 30911517441 reached the stable/latest draft path and covered all 16 required sources, but generated more than the 12-item quality limit. The server correctly returned needs_review=true; the workflow then hid the useful reason in a truncated error and retried the same deterministic rejection.

This update keeps old source refs usable for package builds, makes quality failures inspectable, and guarantees a validation failure stops before npm publish, tag creation, or GitHub Release creation.

Validation

• node --test .github/scripts/*.test.mjs (121/121 passed)
• node --check .github/scripts/draft-local-plugin-release-notes.mjs
• workflow YAML parsed successfully
• git diff --check

No npm publish, tag, GitHub Release, workflow dispatch, 106 webhook, docs PR, or deployment was run. The matching 106 compaction fix is in MemTensor/website#2 and must be merged/deployed before a real stable release validation.

[Memtensor-AI]

🤖 Open Code Review

Target: PR #2199
Task: e729a1a7d91aef79
Base: main
Head: fix/local-plugin-trusted-release-scripts

✅ OpenCodeReview: No comments generated. Looks good to me.

Generated by cloud-assistant via Open Code Review.

[Memtensor-AI]

✅ Automated Test Results: PASSED

All tests passed (1/1 executed). memos_github_open_source/smoke: 1/1. Duration: 2s

Branch: fix/local-plugin-trusted-release-scripts