template: release trusts a signoff receipt without finish, and finish misreads a few readiness forms #416

UAT of #415 at eb6a57c (report nicely-uat-415-2026-10-30.md). #412 and #413 hold. These gaps remain:

1. Release trusts a receipt without just finish. releaseSigned accepts any receipt whose checks all exit 0. A receipt with only just check (the form before 🚑 fix: template: just finish catches hidden lines and findings, and signoff runs it first #415, or one written by hand) let just release v0.0.1 tag and push on a repository with unfilled forms and no readiness.md. Expected: release needs a finish check with exit 0 in the receipt of an extension repository.
2. False positive on the word severity. Prose such as "I kept the severity low" in an advise finding, or a summary table of advise, fails finish. Expected: pass, or a Fix: that names the word or the table as the cause.
3. A warn can still hide. "This is a warn" in prose beside an advise bullet passes. A table | GPS kept | \warn` |under a sibling## Notesafter## Findings` passes. Expected: fail, or name the line.
4. Header message. A # Readiness review title or a UTF-8 BOM before Commit: gives "it holds no line Commit: or Verdict: ". Expected: say "in its first three lines", and ignore a BOM.
5. 5 rounds. AGENTS/rule-index.md says "Stop at Done when or after 5 rounds" is checked by signoff and finish, but nothing counts rounds (a COR-103 round-3 prototype ran 7). Either check it (for example a Round: N line in readiness.md that finish reads) or mark that half as Prose only.

Done when: each case has a test that fails first, and just check passes.