Fix workflow validation and extend black-box CI

[maruwork]

Summary

• fix the Windows workflow validation break caused by PowerShell here-string content escaping the YAML block scalar
• extend consumer black-box CI to prove hold/reopen -> promote and promote HTML guidance
• keep block/unblock and lint coverage in the same hosted consumer flow

Local proof

• check-jsonschema --builtin-schema github-workflows .github/workflows/ci.yml
• pre-commit run check-github-workflows --files .github/workflows/ci.yml
• local installed-command Windows black-box through promote/block/unblock in workspace/tmp/consumer-blackbox-local312