Validate npm extension baselines in release PRs #1990

Need: Catch npm releases that require APIs missing from their declared
minimumExtensionVersion, without making publication depend on GitHub release
lookups. These checks were deferred from #1987 to keep the release fix small;
local metadata validation and package consumer tests remain in place.

Acceptance criteria:

• Run the additional check when a PR changes the npm version or
  minimumExtensionVersion in api/package.json. Ordinary API implementation,
  script-only, and documentation-only PRs must not trigger it.
• Validate the explicitly selected stable extension baseline, not the latest
  stable release. A newer extension release must not invalidate that baseline.
• Reject an unpublished baseline or missing required APIs with actionable
  guidance. Comment and formatting changes alone must not fail the check;
  document what compatibility the chosen approach does and does not establish.
• Keep GitHub release/source lookups out of Azure build/publication and ordinary
  packing. Preserve local metadata and consumer checks, with no new secrets.
• Use required PR checks, existing branch protection, and publication approvals
  to prevent publishing unvalidated release inputs. Document manual-release
  handling without introducing per-publication GitHub status queries or a new
  release-tracking system.
• Test version/minimum changes, ordinary development PRs, branches behind
  main, invalid baselines, and lookup failures. Failed or canceled release
  checks must not satisfy the required merge check.