🐛 Detect GitHub CLI and Nextcloud release workflows

[CAOShurong]

What kind of change does this PR introduce?

Bug fix: extend the GitHub Actions Packaging detector to recognize release workflows that publish with the GitHub CLI or the official Nextcloud App Store API.

What is the current behavior?

IsPackagingWorkflow recognizes package-manager actions and commands, but it does not recognize gh release create/upload/edit or a workflow posting to https://apps.nextcloud.com/api/v1/apps/releases. Such workflows are reported as not being publishing workflows.

What is the new behavior?

The detector now recognizes those two release mechanisms. Read-only gh release view remains a non-match so inspection commands are not treated as publication.

The existing check still requires a successful workflow run before it awards a packaging result; this PR only closes the static workflow-recognition gap.

Which issue(s) this PR fixes

Fixes #5201

Special notes for your reviewer

The matcher uses the existing JobMatcherStep.Run mechanism and adds focused actionlint fixtures for GitHub CLI publication, Nextcloud App Store publication, and the read-only GitHub CLI command.

Focused verification:

• go test ./checks/fileparser -run '^(TestGitHubWorkflowShell|Test_stepsMatch|TestIsPackagingWorkflow)$' -count=1
• go test ./checks/raw/github ./checks/evaluation -count=1
• go vet ./checks/fileparser
• git diff --check

The full go test ./checks/... -count=1 run remains affected by pre-existing Windows/path and fixture failures outside this change (for example TestIsWorkflowFile and unrelated permission/SAST fixtures).

AI assistance disclosure

OpenAI Codex (GPT-5) assisted with issue triage, implementation, and test design; all changes were reviewed and verified locally by the contributor.

:bug: Packaging detects GitHub CLI and Nextcloud App Store release workflows.