fix: match Release Please root title

[tensornull]

Summary

• match the exact root-package PR title emitted by pinned Release Please 17.6.0
• preserve the configured cometapi identity for the temporary branch while excluding it from the title and public tag
• add a mutation test that rejects an invented component title

Real-run evidence

Manual preparation run 30435342700 created the correct 0.1.1 PR #33, then the postcondition validator failed because it expected chore(main): release cometapi 0.1.1. The pinned strategy log showed component: empty, include-component-in-tag=false, and the actual title chore(main): release 0.1.1. No tag, GitHub Release, live request, or npm publication occurred; RELEASE_PLEASE_ENABLED was restored to false before this fix.

Verification

• npm run verify:offline (13 files, 359 tests)
• focused release suites (279 tests)
• npm run check:self-contained on committed HEAD
• npm run actionlint
• git diff --check