ci: enforce digest-only dev releases

.gitea/workflows/ci-cd.yml

@@ -34,6 +34,9 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Validate release client contract
+        run: ./scripts/ci/release-service-test.sh
+
       - name: Install Python and uv
         run: |
           set -euo pipefail