fix(release): classify merge message subject only

[kattsushi]

Problem

After PR #232 promoted the protected beta workflow to master, Release Beta run 33145998054 failed in 🧭 Resolve beta mode and projects before PREPARE.

The resolver scans the full multiline merge commit message for chore(release): or [skip release]. GitHub's merge commit subject was ordinary, but its body contained the PR title chore(release): promote protected beta orchestration, so the workflow falsely classified the push as suspicious and exited 1.

No PREPARE/FINALIZE step executed. No release branch, tag, GitHub Release, or npm package was created.

Approved scope

• .github/workflows/cd.yml
• scripts/release-policy-contract.test.mjs

Required behavior

• Derive the commit subject as the first line of HEAD_MESSAGE.
• Apply release-token message guards only to that subject.
• Continue failing closed when chore(release): or [skip release] is present in the actual subject.
• Preserve structural beta-transition detection and all PREPARE/FINALIZE behavior.

Acceptance criteria

• A regression fixture reproduces the exact multiline merge-message shape from run 33145998054.
• The full message would fail under the old logic, while subject-only classification reaches mode=prepare, has_projects=false, and an empty project selection for the promotion range.
• Adverse mutations that restore full-message matching fail the policy contract.
• Existing 14 release-policy tests remain green.
• YAML, affected lint, repository formatting, and diff checks pass.
• No workflow dispatch, remote ref/tag, GitHub Release, or npm publication occurs while preparing the fix.

Non-goals

• Weakening structural release-PR suppression.
• Retrying PREPARE or FINALIZE in this PR.
• Changing alpha/stable behavior or branch protection.