fix(release): install frozen dependencies for Pages

[smackgg]

Summary

• install the frozen workspace graph before the reusable Pages verifier runs
• prevent Bun auto-install from resolving the published legacy Marketplace Kit instead of the reviewed vendored closure
• enforce this ordering and frozen-lock requirement in the protected publication policy

Root cause

The release candidate was valid and publication succeeded. The fresh Pages runner had no node_modules, so running the verifier directly let Bun auto-install a published package with the same version. That older parser rejected convax.plugin/8 with Plugin manifest schema is unsupported.

Verification

• reproduced the exact failure in a clean worktree without node_modules using run 30613436027 artifact
• verified the same artifact after bun install --frozen-lockfile --ignore-scripts: 25 packages, 26 Releases, 61 assets
• bun run check
• policy and governance regression tests