fix: restore release smoke validation

[gabedalmolin]

Summary

Restore the release-driven production validation path by resolving environment-scoped Railway secrets directly inside the post-deploy validation job.

What changed

• bind the validate deployment job to the same GitHub Environment as the deploy job
• resolve RAILWAY_ENVIRONMENT and RAILWAY_PUBLIC_URL directly in the validation job instead of passing secret-derived values through job outputs
• remove now-unnecessary deploy job outputs for smoke configuration
• bump repository and OpenAPI version metadata to 1.1.2 for the next formal patch release

Validation

• npm run lint
• npm run typecheck
• workflow YAML parsed successfully with the local yaml package

Risks/Notes

• this is a targeted workflow fix after v1.1.1 exposed a secret-scoping issue in the release path
• the next formal release should be v1.1.2