fix(ci): materialize release PR workflow inputs

[bryanwieg]

Summary

• materialize the two trusted master workflow files inspected by CI-helper tests for release-branch PRs
• retain the existing base-sensitive trust boundary: release PRs cannot substitute control-plane inputs
• extend the workflow contract test to cover every trusted checkout path

Verification

• bind920 candidate tests: 31 passed
• bind920 reuse tests: 9 passed
• release provenance tests: 4 passed
• BIND pull-request workflow contract: 8 passed
• independent standards and simplification review: pass

Follow-up to #94; required to make #95's CI-helper job runnable from the intentionally minimal release branch.