Enforce validate:release in CI; add x402 references, docs, and fix validator bug

[GsCommand]

Motivation

• Ensure release-level validation is a first-class, non-optional gate in the existing validation workflow so CI enforces release integrity.
• Anchor the repo to the external x402 protocol spec and make policy and onboarding guidance explicit for release reviewers.
• Fix a parser-level validator bug so local and CI validation commands can run reliably.

Description

• Wire npm run validate:release into the existing .github/workflows/validate.yml pipeline as a required step and switch installs to npm ci with cache: npm for both jobs.
• Add concise x402 compatibility references to README.md and SPEC.md that treat x402 as an external protocol surface and note commercial flows may reference x402 payment/settlement artifacts.
• Expand SECURITY.md with a concrete reporting address (dev@commandlayer.org), supported reporting path, disclosure process, response targets, scope, and out-of-scope items.
• Add an onboarding note that scripts/archive/ is historical-only in ONBOARDING.md and rewrite CHANGELOG.md to explicitly document the v1.0.0 → v1.1.0 migration (added/changed/removed/flattened/moved/legacy/migration notes).
• Fix a duplicate validateLegacyLine function definition in scripts/validate-cards.mjs to resolve a syntax error so validation scripts run.

Testing

• npm ci completed successfully in the environment.
• npm run validate (local current-line and checksum checks) completed successfully.
• npm run validate:release executed but network-based upstream schema fetches failed in this environment due to external raw.githubusercontent.com resolution being blocked (observed 403 CONNECT tunnel failed), so external URL resolution checks did not succeed here.
• npm run validate:legacy completed successfully.

---

Codex Task