Semver release: the suite runs first in CI and in the Unity scripts, and the Caching Unity prefix is its own tag family

publish-packages.yml runs the suite in both jobs, after .NET setup on a full-depth
checkout and before any check or publish step; the three Unity release scripts run
it before the checker. A test reads each file and fails when the step is removed,
moved, or made non-fatal. The Caching Unity pin now needs a prefix declared once
whose exact tags hold the package's own manifest at the tag's version. No NUL byte
in the checker is a test. The policy records that releases run from a full clone.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.github/workflows/publish-packages.yml

@@ -55,6 +55,17 @@ jobs:
           node-version: 24.x
           registry-url: https://registry.npmjs.org
 
+      # The suite pins the release checker's rules and the declared tag prefixes
+      # (docs/semver-policy.md). It runs before any check or publish step, on a
+      # checkout that holds every tag.
+      - name: Set up .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+
+      - name: Test the release checks
+        run: node --test scripts/check-changelog-semver.test.mjs
+
       - name: Install workspace dependencies
         run: npm ci
 
@@ -138,6 +149,17 @@ jobs:
         with:
           node-version: 24.x
 
+      - name: Set up .NET
+        if: steps.selected.outputs.run == 'true'
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+
+      # See the same step in the npm job: the suite comes before any check or publish step.
+      - name: Test the release checks
+        if: steps.selected.outputs.run == 'true'
+        run: node --test scripts/check-changelog-semver.test.mjs
+
       - name: Verify the tag matches the manifest version
         if: steps.selected.outputs.run == 'true' && startsWith(github.ref, 'refs/tags/')
         run: |