feat: AffineScript port of tests/validate.test.ts (TS->AS campaign step 2) (#25)

* feat(security): fleet-wide workflow hardening (SHA pinning + permissions)

* feat: AffineScript port of tests/validate.test.ts (TS->AS campaign step 2)

Additive port of tests/validate.test.ts to tests/validate.test.affine
plus compiled tests/validate.test.deno.js (Deno-ESM target).

All 22 structural-validation tests pass via:
  deno run --allow-read tests/validate.test.deno.js

The .ts source is retained (additive port; standards#241 TAIL BATCH 1
guidance). Coverage parity:

  * UNIT / SMOKE / E2E / CONTRACT / ASPECT / BENCHMARK arms all ported
  * TOML "parse without error" assertion replaced with regex-based
    well-shaped-and-non-empty check (AffineScript has no TOML stdlib
    binding today; documented gap in PR body).
  * Field-presence assertions converted from `parseTOML(...)` lookups
    to anchored regex matches against the raw text -- functionally
    equivalent for the invariants this suite protects.

Compile invocation:
  AFFINESCRIPT_STDLIB=.../affinescript/stdlib \
    affinescript compile --deno-esm \
    -o tests/validate.test.deno.js tests/validate.test.affine

Part of hyperpolymath/standards#239 / standards#241.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/release.yml

@@ -34,7 +34,7 @@ jobs:
           #   mix release
 
       # TODO: Upload build artifacts if needed
-      # - uses: actions/upload-artifact@v4
+      # - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       #   with:
       #     name: release-artifacts
       #     path: target/release/
@@ -94,7 +94,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       # TODO: Download build artifacts if uploading to the release
-      # - uses: actions/download-artifact@v4
+      # - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       #   with:
       #     name: release-artifacts
       #     path: artifacts/