v0.2.4 second/third dispatches would have failed at gates 2 and 3
respectively after #973's gate-1 relaxation. Both rejections were
false positives on routine post-release tidy output:

- Gate 2 (no go.sum deletions) rejected tidy's orphan pruning when
  an `// indirect` require is removed (kr/text disappeared with
  the v0.2.2 transitive shift). go.sum deletions reflect the local
  require graph, not proxy-supplied data; the supply-chain threat
  manifests through ADDED entries that gate 4 (sumdb cross-check)
  defends. Gate 2 is now retired.

- Gate 3 ("every added line in publishedModules at the released
  version") rejected legitimate transitive additions like
  `axonops/syncmap` and `golang.org/x/crypto` that v0.2.2's go.mod
  pulls in. The relaxed rule only enforces the version constraint
  on lines in our `github.com/axonops/audit/*` namespace; third-
  party transitives pass through and are validated by gate 4. The
  original threat (namespace squatter like `github.com/evil/audit`)
  is still caught — the defending gate shifts from 3 to 4 (sumdb
  has no record for the squatter and returns msgSumdbTransient).

Verified end-to-end locally against the actual `make tidy` diff
this time:
  preflight-tidy-check ... → rc=0
  github.com/axonops/audit v0.2.2
  github.com/axonops/audit/file v0.2.2
  ... (all 13 axonops/audit/* modules) ...
  github.com/axonops/syncmap v1.0.0
  golang.org/x/crypto v0.52.0

Changes:
- cmd/release-tool/cmd_preflight_tidy_check.go:
  - msgGoSumDeletions, hasGoSumDeletions removed.
  - Gate 2 call site retired with rationale comment.
  - linesAreInExpectedSet only validates the version constraint
    on axonops/audit/* lines (new isOurModule helper).
  - Help text reflects the new gate semantics.
- cmd/release-tool/cmd_preflight_tidy_check_test.go:
  - Gate2_DeletionsAbort → GoSumDeletionsAllowed (regression
    anchor: deletions must pass).
  - Gate3_UnrelatedModuleAborts → Gate3_NamespaceSquatterCaughtByGate4
    (regression anchor: the attack is now defended at gate 4 not 3).
  - New Gate3_TransitiveDepAllowed: golang.org/x/crypto and
    axonops/syncmap added lines pass gate 3 and are verified by
    gate 4 against fake sumdb.
- tests/release-scripts/release-yml-grep.bats: drop the
  test_release_yml_preflight_tidy_rejects_deletions test; drop
  the gate-2 anchor from _emits_exact_error_strings.
- docs/releasing.md: failure-mode table updated. Row 2 marked
  retired; row 3 reflects the namespace-narrowed rule.
- CHANGELOG.md: two new [Unreleased] / Fixed entries (#975, #976).

Verifications:
- `go test ./cmd/release-tool/... -count=1` clean.
- `golangci-lint run ./cmd/release-tool/...` 0 issues.
- `make test-release-scripts` 116/116 pass.
- `make regen-llms` clean.
- End-to-end: real `make tidy` on main produces rc=0.

Closes #975 and #976.