fix(docs): keep candidate tag selection self-contained

[jeremi]

Summary

• select the newest release identity directly from release manifests with the docs site declared yaml dependency
• validate release ID, filename, stable version, repository, and exact source-tag identity before allowing the pre-publication evidence exception
• remove the narrow evidence-link check dependency on a globally installed PyYAML module

This follows up automated review on release PR #723 and must land before that release metadata is rebased for candidate construction.

Verification

• npm ci (0 vulnerabilities)
• node --test scripts/check-evidence-links.test.mjs (17 passed)
• npm test (323 passed)
• npm run check:evidence-links (66 links)
• npm run check
• git diff --check